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ABSTRACT 


This  thesis  provides  a  review  of  the  process  of  evaluating 
internal  control  systems  for  the  Federal  Managers '  Financial 
Integrity  Act  and  the  application  of  the  concept  of  materiality 
to  that  process. 

Topics  considered  include:   internal  control  in  the 
Federal  Government;  internal  control  evaluation  in  the  Federal 
Government;  the  concept  of  materiality  in  the  private  sector 
and  the  Federal  Government;  and  guidelines  for  determining 
material  weaknesses  in  internal  control  systems.   The  conclu- 
sion was  reached  that  with  additional  training  in  the  area 
of  materiality,  and  supported  with  a  material  weakness  check- 
list, managers  in  the  Federal  Government  can  better  fulfill 
their  requirements  for  internal  control  evaluation. 

The  research  consisted  primarily  of  a  detailed  search  and 
evaluation  of  the  literature  in  the  area  of  internal  control 
evaluation  in  the  Federal  Government  and  the  concept  of 
materiality  both  in  the  private  sector  and  the  Federal 
Government. 
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I.   INTRODUCTION 

A.  PURPOSE 

The  Federal  Managers'  Financial  Integrity  Act  of  19  8  2 
requires  the  head  of  each  executive  department  to  report  on 
their  agencies'  internal  control  systems  annually.   Included 
in  this  report  is  a  statement  on  the  "material  weaknesses", 
if  any,  in  the  agency's  system  of  internal  control.   In  the 
current  implementation  of  the  act,  much  concern  is  given  to 
the  lack  of  a  meaningful  definition  of  what  constitutes  a 
material  weakness.   This  confusion  stems  from  the  fact  that 
the  concept  of  materiality,  a  widely  used  accounting  term  in 
the  private  sector,  is  subject  to  considerable  debate  over 
its  meaning  and  application.   The  purpose  of  this  thesis  is 
to  review  the  process  of  evaluating  internal  control  systems, 
and  the  application  of  the  concept  of  materiality  to  that 
process . 

B .  BACKGROUND 

In  response  to  growing  reports  of  fraud,  waste  and  abuse 
in  the  Federal  government  the  Ninety-seventh  Congress  of  the 
United  States  of  America  passed  the  Federal  Managers'  Finan- 
cial Integrity  Act  of  1982  (FMFIA) .   The  stated  purpose  of 
the  FMFIA  is: 

To  amend  the  Accounting  and  Auditing  Act  of  19  50 
to  require  ongoing  evaluations  and  reports  on  the  adequacy 
of  the  systems  of  internal  accounting  and  administrative 


10 


control  of  each  executive  agency,  and  for  other  purposes. 
[Ref.  1J 

The  FMFIA  directed  the  Office  of  Management  and  Budget  (OMB) 

in  consultation  with  the  Comptroller  General  of  the  United 

States  to  establish  guidelines  for  these  evaluations  and 

reports . 

The  OMB  responded  to  the  requirements  of  the  FMFIA  by 
revising  their  Circular  No.  A-123.   This  Circular  was 
originally  published  in  19  81  to  promulgate  standards  of 
internal  control  for  agencies  in  the  Federal  government.   The 
revised  edition  incorporates  the  requirements  of  the  FMFIA. 
The  primary  mechanism  utilized  by  A-12  3  to  accomplish  the 
goals  of  the  FMFIA  is  the  requirement  for  each  executive 
agency  to  conduct  annual  evaluations  of  its  system  of  internal 
accounting  and  administrative  control  and  report  to  the  Presi- 
dent and  Congress  on  the  status,  of  that  system.   An  integral 
part  of  this  report  is  a  statement  identifying  material  weak- 
nesses, if  any,  in  the  agencies'  internal  control  system. 

It  is  this  requirement  to  report  on  material  weaknesses 
in  internal  control  systems  that  has  created  problems  in  the 
implementation  of  the  FMFIA.   To  report  on  a  material  weak- 
ness, one  first  has  to  understand  the  meaning  of  the  term. 
In  A-123,  the  OMB  defined  a  material  weakness  as: 

...a  situation  in  which  the  designed  procedures  or  degree 
of  operational  compliance  therewith  does  not  provide 
reasonable  assurance  that  the  objectives  of  internal  con- 
trol specified  in  the  Act  are  being  accomplished. 
[Ref.  2] 

This  definition  while  possibly  having  some  meaning  to  persons 

familiar  with  the  technical  language  of  public  accounting, 
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provides  little  guidance  for  the  managers  required  to  make 
the  evaluations.   Indeed,  both  the  General  Accounting  Office 
(GAO) ,  and  the  Congress  in  their  evaluations  of  first  year 
implementation  of  the  FMFIA  pointed  out  the  need  for  a  more 
practical  definition  of  material  weakness.   The  need  for 
practical  definitions  stems  from  the  fact  that  internal  con- 
trol, materiality,  reasonable  assurance  and  other  nomenclature 
used  in  both  the  FMFIA  and  A-123  are  not  normally  used  by 
managers  of  Federal  agencies.   To  successfully  implement  the 
requirements  of  the  FMFIA  and  A-12  3,  agencies  in  the  Federal 
government  must  provide  their  managers  with  practical  defini- 
tions of  these  terms  and  their  application. 

C.   SCOPE  AND  METHODOLOGY 

The  objective  of  this  thesis  is  to  research  the  concept 
of  materiality,  and  attempt  to  apply  it  to  the  evaluation  of 
internal  control  systems  in  the  Federal  government. 

The  history  and  evolution  of  internal  control  in  the 
Federal  Government  will  be  reviewed  from  the  Accounting  and 
Auditing  Act  of  19  50,  to  the  requirements  of  the  Federal 
Managers'  Financial  Integrity  Act  of  1982  (FMFIA)  and  their 
implementation . 

The  standards  of  internal  control  in  the  Federal  Govern- 
ment will  be  presented  in  order  to  provide  a  background  for 
the  evaluation  of  internal  control  systems.   This  includes 
both  the  general  and  specific  standards  of  internal  control. 
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In  depth  coverage  is  given  to  the  process  for  internal 
control  evaluation  in  the  Federal  Government.   The  organiza- 
tion and  implementation  of  this  process  is  the  essential 
element  of  the  FMFIA.   An  understanding  of  this  evaluation 
and  the  results  from  it,  is  critical  to  the  evaluation  of 
internal  control  weaknesses. 

Managers  in  the  Federal  Government  must  understand  the 
concept  of  materiality  to  evaluate  their  systems  of  internal 
control  for  material  weaknesses.   Therefore,  this  concept  is 
reviewed  as  it  is  applied  in  the  private  sector  for  financial 
statement  reporting  and  auditing.   Additional  coverage  is 
given  to  the  concept  of  materiality  as  it  is  applied  in  the 
Federal  Government. 

Using  the  information  gained  from  the  research,  the  author 
develops  guidelines  to  assist  managers  in  the  determination  of 
material  weaknesses  in  internal  control  systems.   These  guide- 
lines are  incorporated  into  a  checklist  to  be  used  in  the 
evaluation  of  control  weaknesses. 

Finally,  the  conclusion  is  reached  that  managers  in  the 
Federal  Government  need  more  training  in  the  concept  of 
materiality.   With  this  training  and  the  use  of  aids  like 
the  material  weakness  checklist,  managers  in  the  Federal 
Government  can  better  fulfill  their  requirements  for  internal 
control  evaluation  under  the  FMFIA. 

The  research  consisted  primarily  of  a  detailed  search  and 
evaluation  of  the  literature  in  the  area  of  internal  control 
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systems  and  their  evaluation  in  the  Federal  Government,  and 
the  concept  of  materiality. 
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II.   INTERNAL  CONTROL  IN  THE  FEDERAL  GOVERNMENT 

A.  INTRODUCTION 

This  chapter  provides  background  on  internal  control  in 
the  Federal  Government.   Topics  to  be  considered  include  the 
legislation  affecting  the  development  of  internal  control  in 
the  Federal  Government,  guidelines  for  those  controls  and 
the  standards  of  internal  control  in  the  Federal  Government. 

B.  ACCOUNTING  AND  AUDITING  ACT  OF  19  50 

The  modern  concept  of  internal  control  in  the  Federal 
Government  finds  its  roots  in  the  Accounting  and  Auditing  Act 
of  19  50  which  required  the  heads  of  agencies  in  the  Federal 
Government  to  establish  and  maintain  adequate  systems  of  account- 
ing and  internal  control.   Among  other  requirements  these 
systems  were  to  be  designed  to  provide  "effective  control 
over  and  accountability  for  all  funds,  property,  and  other 
assets  for  which  the  agency  is  responsible,  including  appro- 
priate internal  audit"  [Ref.  3]. 

The  Act  required  the  General  Accounting  Office  to  cooper- 
ate in  the  development  of  the  internal  control  systems  and 
the  Comptroller  General  to  approve  them.   In  addition  the 
General  Accounting  Office  was  directed  to  review  these  systems 
from  time  to  time.   However  the  act  did  not  provide  specific 
guidance  on  internal  control  systems  or  require  mandatory 
reports  on  the  quality  of  those  systems. 
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C.  OFFICE  OF  MANAGEMENT  AND  BUDGET  CIRCULAR  A-123 

Even  though  the  Accounting  and  Auditing  Act  of  19  50  re-r 
quired  the  development  of  internal  control  systems,  the 
development  of  such  systems  was  slow.   In  19  80  the  General 
Accounting  Office  released  a  study  that  disclosed  instances 
of  fraud,  waste  and  abuse.   In  addition  the  study  found  poor 
internal  controls  in  many  agencies.   [Ref.  4] 

As  a  result  of  the  disclosure  of  fraud,  waste  and  abuse, 

the  Office  of  Management  and  Budget  released  Circular  A-12  3 

in  October  of  1981.   This  circular  required  agencies  of  the 

Federal  Government  to  establish  policies  on  internal  controls. 

It  defined  internal  controls  as : 

the  plan  for  oragnization  and  all  the  methods  and  measures 
adopted  within  an  agency  to  safeguard  its  resources, 
assure  the  accuracy  and  reliability  of  the  information, 
assure  adherence  to  applicable  laws,  regulations  and 
policies,  and  promote  operational  economy  and  efficiency. 
[Ref.  5] 

Unlike  the  Accounting  and  Auditing  Act  of  19  50,  Circular 

A-123  directed  agencies  to  establish  directives  on  internal 

control,  required  an  assessment  of  the  inherent  risk  to  fraud, 

waste  and  abuse  of  an  activity  and  provided  for  a  review  of 

internal  controls.   These  steps  were  taken  to  provide  for  the 

realization  of  the  provisions  of  the  act  of  1950. 

D.  FEDERAL  MANAGERS'  FINANCIAL  INTEGRITY  ACT  OF  19  8  2 

In  September  of  1982  the  97th  Congress  of  the  United 
States  passed  an  amendment  to  the  Accounting  and  Auditing 
Act  of  1950.   This  Act  required  that  each  agency  of  the 
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Federal  Government  establish  internal  accounting  and  admin- 
istrative controls.   The  Act  specifically  required  that 
these  controls  would  provide  reasonable  assurance  that: 

(i)     obligations  and  costs  are  in  compliance  with 
applicable  law; 

(ii)    funds,  property,  and  other  assets  are  safeguarded 
against  waste,  loss,  unauthorized  use,  or  mis- 
appropriation; and 

(iii)  revenues  and  expenditures  applicable  to  agency 
operations  are  properly  recorded  and  accounted 
for...  [Ref.  6] 

Although  the  Act  did  not  define  the  meaning  of  internal  and 

administrative  controls  or  what  "reasonable  assurance"  meant, 

it  did  direct  the  Comptroller  General  to  provide  such  standards 

In  an  effort  to  insure  that  the  requirements  of  this  Act 
were  met,  Congress  included  a  provision  for  the  head  of  each 
agency  to  conduct  an  annual  evaluation  of  their  system  of 
internal  control.   A  report  of  this  evaluation  must  be  made 
to  the  President  and  to  Congress.   Among  other  things  this 
report  must  include  a  statement  that  the  agency's  systems  of 
internal  and  administrative  controls  are  in  compliance  with 
the  Act.   If  they  are  not,  an  additional  statement  identify- 
ing those  material  weaknesses  in  the  agency's  systems  of 
internal  accounting  and  administrative  control  must  be  included 

The  Act  directed  the  evaluation  and  reporting  requirements 
to  be  implemented  in  two  steps.   The  first  step  was  the 
preparation  of  guidelines  for  the  evaluation  of  internal  and 
administrative  controls  by  the  Office  of  Management  and  Budget 
in  consultation  with  the  Comptroller  General  by  December  31, 
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1982.   The  second  step  required  the  commencement  of  annual 
reporting  by  the  agencies  by  December  31,  1983. 

E.   STANDARDS  FOR  INTERNAL  CONTROLS  IN  THE  FEDERAL  GOVERNMENT 

In  1983  the  General  Accounting  Office  published  the 

internal  control  standards  of  the  Comptroller  General  that 

were  required  by  the  Federal  Managers*  Financial  Integrity 

Act  of  19  82.   This  document  included  the  following  definition 

of  an  internal  control  standard: 

The  internal  control  standards  define  the  minimum 
level  of  quality  acceptable  for  internal  control  systems 
in  operation  and  constitute  the  criteria  against  which 
systems  are  to  be  evaluated.   These  internal  control 
standards  apply  to  all  operations  and  administrative 
functions...  [Ref.  7] 

This  definition  makes  clear  that  these  standards  are  to  apply 
not  only  to  traditional  areas  of  internal  control  (i.e., 
financial  or  accounting  systems) ,  but  also  to  administrative 
functions.   Indeed,  almost  every  activity  that  is  conducted 
by  an  agency  is  subject  to  an  internal  control.   These  con- 
trols may  be  in  the  form  of  instructions,  standards  of  per- 
formance, mission  requirements,  program  objectives,  etc. 

The  standards  for  internal  control  in  the  Federal  Govern- 
ment are  broken  into  three  areas:   general  standards  of 
internal  control,  specific  standards  of  internal  control  and 
the  audit  resolution  standard.   The  general  and  specific 
standards  will  be  discussed  in  detail. 

1 .   General  Standards  of  Internal  Control 

The  general  standards  apply  to  all  aspects  of  internal 
control.   They  include  the  following  five  standards. 
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a.  Reasonable  Assurance 

"Internal  control  systems  are  to  provide  reason- 
able assurance  that  the  objectives  of  the  systems  will  be 
accomplished"  [Ref.  7:  p.  4].   The  standard  of  reasonable 
assurance  is  subject  to  considerable  judgment.   This  is  be- 
cause an  internal  control  should  be  cost-beneficial.   The 
benefits  of  having  the  control  should  not  outweigh  the  costs 
whether  financial,  in  lost  opportunity  or  whatever  the  control 
is  meant  to  accomplish.   The  benefit  to  be  derived  from  a 
control  consists  of  the  reduction  in  risk  of  failing  to  achieve 
the  objective  of  the  control.   The  objective  might  be  stated 
in  absolute  terms  such  as  "there  will  be  no  theft  of  govern- 
ment vehicles,"  or  it  may  be  stated  as  a  minimum  level  of 
control  such  as  "the  loss  of  government  ball  point  pens  will 
be  held  to  ten  percent."   Increasing  the  amount  of  control  in 
the  objective  will  result  in  an  increase  in  cost.   Therefore 
each  control  must  be  judged  as  to  its  objective,  benefit  and 
cost. 

b.  Supportive  Attitude 

"Managers  and  employees  are  to  maintain  and 
demonstrate  a  positive  and  supportive  attitude  toward 
internal  controls  at  all  times"  [Ref.  7:  p.  4].   The  attitude 
displayed  by  the  management  of  an  agency  and  its  employees 
to  internal  control  plays  a  large  part  in  the  effectiveness 
of  these  controls.   This  standard  requires  that  a  positive 
and  supportive  attitude  be  maintained.   The  initiative  for 
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this  rests  with  management.   Their  concern  for  the  conception, 
implementation  and  operation  of  internal  control  is  reflected 
in  the  employees.   Such  practices  as  encouraging  internal 
review,  providing  training  for  employees  in  internal  control 
and  prompt  response  to  audit  findings  will  contribute  to  a 
supportive  attitude. 

c.  Competent  Personnel 

"Managers  and  employees  are  to  have  personal  and 
professional  integrity  and  are  to  maintain  a  level  of  compe- 
tence that  allows  them  to  accomplish  their  assigned  duties,  as 
well  as  understand  the  importance  of  developing  and  imple- 
menting good  internal  controls"  [Ref.  7:  p.  5].   Managers 
and  their  staffs  are  required  to  maintain  and  demonstrate 
integrity  (both  personally  and  professionally) ,  an  appropriate 
skill  level  and  an  understanding  of  internal  controls  suffi- 
cient for  their  responsibilities.   Integrity  is  expected,  and 
is  maintained  through  codes  of  conduct.   Personnel  should  be 
reminded  of  this  obligation  periodically.   Personnel  should 
not  be  hired  unless  they  meet  the  minimum  requirements  of 
education  for  their  job  and  this  should  be  verified.   In 
addition  training  should  be  provided  both  formally  and  on-the- 
job.   To  insure  that  personnel  are  competent  they  should  be 
reviewed  for  proper  performance  and  counseled  if  found  to 
be  lacking. 

d.  Control  Objectives 

"Internal  control  objectives  are  to  be  identified 
or  developed  for  each  agency  activity  and  are  to  be  logical, 
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applicable,  and  reasonably  complete"  .[Ref.  7:  p.  6J  .   The 
objectives  of  internal  control  must  be  tailored  to  the  agency 
for  each  of  its  operations.   To  establish  this  the  operations 
of  an  agency  are  grouped  into  cycles  such  as  agency  management, 
financial,  program  (operational)  and  administrative.   Each 
agency  must  determine  its  cycles  and  establish  the  control 
objectives  around  these.   It  must  be  remembered  that  these 
cycles  will  interface  with  and  affect  the  others.   When  these 
cycles  are  analyzed  in  detail  it  is  possible  to  evaluate  the 
objectives  of  the  cycle  and  establish  controls  to  meet  those 
objectives.   The  standard  of  reasonable  assurance  should  be 
included  in  this  process. 

e.   Control  Techniques 

"Internal  control  techniques  are  to  be  effective 
and  efficient  in  the  accomplishment  of  their  internal  control 
objectives"  [Ref.  7:  p.  7].   The  final  general  standard  re- 
quires that  the  techniques  of  control  are  both  effective  and 
efficient.   These  techniques  are  the  controls  which  accomplish 
the  objectives  of  the  agency.   Such  controls  could  be  as  simple 
as  a  guard  to  prevent  unauthorized  entry  to  a  secure  space  or 
separation  of  duties  in  a  receiving  department  to  prevent  the 
person  taking  custody  of  goods  to  account  for  their  receipt. 
The  control  could  be  more  complex  such  as  rules-of-engagement 
for  military  forces  to  prevent  international  incidents.   What- 
ever their  form,  control  techniques  should  insure  that  the 
objective  is  met  within  the  cost  limitations.   These 
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techniques  must  be  subject  to  continuing  evaluation  and  be 
adapted  as  necessary. 

2 .   Specific  Standards 

Even  though  each  agency  must  define  its  own  control 
techniques,  there  are  certain  essential  techniques  which  are 
critical  to  assure  an  agency  meets  their  objectives.   These 
are  the  six  specific  standards. 

a.  Documentation 

"Internal  control  systems  and  all  transactions 
and  other  significant  events  are  to  be  clearly  documented, 
and  the  documentation  is  to  be  readily  available  for  examination" 
[Ref .  7:  p.  8] .   This  standard  can  be  summed  up  simply  as 
"write  it  down."   Specifically,  it  requires  that  the  internal 
controls  of  an  organization,  their  objectives,  techniques 
and  all  other  significant  events  of  an  organization  be  main- 
tained in  writing.   This  standard  insures  that  the  agency 
has  their  system  of  internal  control  in  directives,  manuals, 
etc.,  and  also  provides  auditors  with  a  guide  for  their  review. 

b.  Recording  of  Transactions  and  Events 
"Transactions  and  other  significant  events  are 

to  be  promptly  recorded  and  properly  classified"  [Ref.  7: 
p.  9].   While  similar  in  nature  to  the  standard  of  documenta- 
tion, this  standard  specifically  calls  for  the  design, 
implementation  and  maintenance  of  an  information  system. 
While  this  system  may  be  manual  or  automated,  it  should  insure 
that  a  record  is  maintained  of  each  event  through  its  entire 
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cycle,  beginning  to  end.   This  standard  provides  management 
with  the  information  it  needs  to  control  operations  and 
provides  records  for  internal  review  and  audits. 

c.  Execution  of  Transactions  and  Events 
"Transactions  and  other  significant  events  are 

to  be  authorized  and  executed  only  by  persons  acting  within 
the  scope  of  their  authority"  [Ref.  7:  p.  9].   The  purpose 
of  this  standard  is  to  insure  that  an  agency  and  its  activi- 
ties only  involve  themselves  in  legitimate  activities.   The 
technique  used  is  that  of  authorization.   Without  proper 
authorization  a  transaction  should  not  be  entered  into.   An 
example  of  this  would  be  the  fueling  of  a  personal  vehicle 
with  government  fuel.   The  control  could  be  a  lock  on  the 
pump  with  the  key  issued  by  a  supervisor  who  maintained  logs 
of  vehicles  fueled  and  miles  driven.   In  order  to  insure 
compliance  with  this  standard,  authorization  must  be  clearly 
understood  by  all  personnel  involved. 

d.  Separation  of  Duties 

"Key  duties  and  responsibilities  in  authorizing, 
processing,  recording,  and  reviewing  transactions  should  be 
separated  among  individuals"  [Ref.  7:  p.  10],   Key  duties 
include  authorizing,  approving  and  recording  events,  issuing 
and  receiving  assets,  making  payments,  etc.   The  primary 
factor  for  deciding  when  to  separate  duties  is  if  the  per- 
formance of  the  duties  by  one  person  would  allow  that  person 
to  commit  fraud,  waste  or  abuse.   An  example  would  be  an 
accounts  payable  clerk  that  issued  the  checks  to  pay  those 
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accounts.   This  clerk  could  update  the  records  that  an  account 
had  been  paid  and  then  issue  a  check  to  him/herself.   To 
prevent  this,  those  duties  are  separated.   It  should  be  noted 
that  this  control  will  not  prevent  the  collusion  of  two  or 
more  persons  performing  key  duties . 

e.  Supervision 

"Qualified  and  continuous  supervision  is  to  be 
provided  to  ensure  that  internal  control  objectives  are 
achieved"  [Ref.  7:  p.  10 J  .   This  standard  includes  not  only 
the  monitoring  of  employee  performance  but  also  that  they  re- 
ceive training  and  direction.   This  should  include  the  com- 
munication of  duties,  responsibilities  and  accountability  to 
personnel,  periodic  review  of  performance  and  the  approval  of 
work  at  critical  points  to  ensure  timely  completion.   It  is 
this  standard  that  ties  together  internal  controls  and  can 
prevent  weaknesses  such  as  collusion  from  occurring. 

f.  Access  to  and  Accountability  for  Resources 
"Access  to  resources  and  records  is  to  be  limited 

to  authorized  individuals,  and  accountability  for  the  custody 
and  use  of  resources  is  to  be  assigned  and  maintained.   Periodic 
comparison  shall  be  made  of  the  resources  with  the  recorded 
accountability  to  determine  whether  the  two  agree.   The  fre- 
quency of  the  comparison  shall  be  a  function  of  the  vulnera- 
bility of  the  asset"  [Ref.  7:  p.  11].   Every  agency  and 
activity  in  the  Federal  Government  has  assets.   These  assets 
must  be  protected  from  fraud,  waste  and  abuse.   However,  some 
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assets  are  more  vulnerable  to  fraud,  waste  and  abuse  than 
others.   This  is  because  of  factors  such  as;  value,  ease  of 
theft,  east  of  resale,  etc.   An  example  would  be  a  comparison 
of  aircraft  engines  and  typewriters.   An  aircraft  engine  would 
not  be  a  likely  candidate  for  abuse  because  of  its  size  and 
limited  marketability.   However,  typewriters  could  be  easily 
transported  and  are  very  marketable.   Therefore  it  stands  to 
reason  that  one  requires  more  control  than  the  other.   Each 
agency  must  evaluate  its  resources  and  establish  controls 
that  provide  reasonable  assurance  that  these  resources  are 
protected  and  used  only  as  authorized. 

F.   CONCLUSION 

The  implementation  of  internal  control  systems  within  the 
Federal  Government  has  been  a  continuing  (albeit  slow)  process 
over  the  last  three  decades  or  so.   However,  passage  of  the 
Federal  Managers'  Financial  Integrity  Act  of  1982  requires 
implementation  and  evaluation  of  these  controls. 

The  standards  for  internal  controls  promulgated  by  the 
Comptroller  General  must  be  understood  by  personnel  imple- 
menting and  evaluating  these  systems.   However,  it  must  be 
remembered  that  these  standards  are  broad  guidelines  and 
management  is  responsible  for  the  establishment  of  their  own 
specific  controls. 

With  an  understanding  of  internal  control  in  the  Federal 
Government  we  will  now  discuss  the  evaluation  of  internal 
control  systems. 
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III.   INTERNAL  CONTROL  EVALUATION  IN  THE  FEDERAL  GOVERNMENT 

A.   INTRODUCTION 

The  evaluation  of  internal  controls  has  been  practiced  in 

the  private  sector  by  public  accountants  for  a  number  of  years. 

However,  the  nature  and  scope  of  these  evaluations  is  by  no 

means  in  general  agreement.   As  noted  in  the  Handbook  Of 

Accounting  And  Auditing: 

Although  auditors  have  studied  and  used  evaluations 
of  internal  accounting  controls  for  many  years ,  the 
professionals  still  debate  the  best  and  most  effective 
way  to  do  so .   [Ref.  8] 

With  the  passage  of  the  Federal  Managers'  Financial  Integrity 
Act  of  1982,  Congress  directed  agencies  in  the  Federal  Govern- 
ment to  conduct  evaluations  of  their  systems  of  internal  con- 
trol.  Furthermore,  the  Act  directed  the  Office  of  Management 
and  Budget  to  develop  and  promulgate  guidelines  for  the 
evaluation  of  internal  controls.   These  guidelines  were  re- 
leased in  December,  1982  and  are  based  on  techniques  similar 
to  those  used  by  financial  auditors  to  evaluate  internal  con- 
trol in  the  preparation  of  financial  statements.   However, 
the  OMB  guidelines  are  expanded  to  include  administrative  and 
program  activity  controls  since  the  audit  of  financial  state- 
ments does  not  normally  include  administrative  controls. 
Rather  the  evaluation  of  internal  control  in  the  process  of 
financial  statement  audits  is  designed  to  give  the  auditor 
confidence  in  the  internal  control  system  thus  reducing  the 
number  of  actual  transactions  examined. 
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An  understanding  of  the  internal  control  evaluation  proc- 
ess is  necessary  before  one  can  do  such  evaluations  and  ana- 
lyze the  results.   In  the  guidelines  published  by  the  Office 
of  Management  and  Budget  [Ref .  9] ,  a  seven  phase  approach  is 
outlined  for  the  evaluation,  improvement  and  reporting  on 
internal  controls.   They  include  the  organization  of  the 
process,  segmenting  the  agency  for  evaluation,  vulnerability 
assessments,  evaluation  planning,  conducting  the  evaluation, 
corrective  action  and  reporting  on  the  evaluation.   This 
chapter  will  focus  on  this  process. 

B.   ORGANIZING  THE  EVALUATION  PROCESS 

In  order  for  the  evaluation  of  internal  controls  to  be 
effective,  the  process  must  be  understood  by  all  involved. 
Organizing  provides  the  framework  for  the  remainder  of  the 
evaluation  effort.   The  primary  considerations  for  this  step 
follow. 

1 .   Assignment  Of  Responsibility 

The  responsibility  for  the  annual  report  required  on 
the  evaluation  of  internal  controls  rests  with  the  head  of 
the  agency.   The  preparation  of  the  report  is  carried  out  by 
the  systematic  delegation  of  duties  throughout  the  agency. 
This  delegation  must  be  based  on  the  size  of  the  agency,  its 
organization,  functions,  objectives,  etc.   However,  certain 
points  remain  common.   One  is  the  assignment  of  a  senior 
official  with  overall  responsibility  for  the  process.   This 
official  oversees  the  heads  of  organizational  units  and  they 
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in  turn  oversee  the  heads  of  the  activities  they  are  respon- 
sible for.   Ideally  the  process  should  be  organized  along  the 
organizational  lines  that  the  agency  operates,  down  to  the 
lowest  feasible  responsibility  level. 

In  addition  to  the  delegation  of  line  management 
responsibility,  the  Inspector  General  or  equivalent  of  the 
agency,  audit  functions  of  the  agency  and  internal  review 
functions  already  in  existence  can  be  used  to  help  in  the 
organizing  process.   This  can  also  prevent  duplication  of 
effort  when  the  actual  evaluation  is  performed. 

2 .  System  For  Internal  Reporting  Of  Evaluation  Process 
In  order  to  insure  that  the  evaluation  process  is 

performed  in  a  timely  manner  consistent  with  the  program 
designed  for  the  agency,  there  must  be  a  system  to  follow-up 
and  report  on  the  process.   This  system  should  include  track- 
ing for  vulnerability  assessments,  internal  control  reviews 
and  corrective  action  taken  in  response  to  weaknesses  revealed 
in  the  evaluation.   The  purpose  of  this  system  is  to  provide 
information  for  annual  reporting  and  to  aid  the  improvement 
of  internal  controls  by  providing  management  with  the  requi- 
site information  on  the  evaluation. 

3 .  Documentation 

Just  as  proper  documentation  is  a  standard  of  internal 
control,  it  is  also  a  requirement  for  the  evaluation  process. 
This  documentation  should  consist  of  all  instructions  related 
to  the  implementation  of  the  process,  the  record  of  vulnera- 
bility assessments,  internal  control  reviews,  follow-up  action 

28 


and  anything  else  that  would  be  considered  relevant  to  the 
evaluation  process.   This  is  to  provide  management  with 
information  that  will  confirm  the  validity  of  the  evaluation 
process  and/or  improve  it. 

4 .  Training  And  Supervision  Of  Personnel 

In  order  to  provide  maximum  effectiveness  in  the 
improvement  of  an  agency's  system  of  internal  control  the 
evaluation  process  should  involve  personnel  down  to  the  lowest 
level  of  responsibility.   In  most  instances  these  people  will 
have  little  or  no  background  in  internal  control.   Therefore, 
an  agency  must  design  a  program  of  training  for  these  people. 
It  should  provide  an  understanding  of  internal  controls, 
vulnerability  assessments,  internal  control  reviews  and  the 
like.   The  agency  may  use  available  information  on  these 
areas  but  it  must  also  include  their  own  instructions  on  the 
evaluation  process. 

When  the  personnel  that  are  involved  in  the  process 
have  received  training,  the  evaluation  can  be  performed  but 
adequate  supervision  must  be  provided.  This  should  include 
technical  assistance,  monitoring  of  the  personnel  and  an 
individual  appraisal  of  their  peformance.  To  insure  proper 
performance,  personnel  should  be  advised  that  their  perfor- 
mance in  the  evaluation  process  will  be  included  in  their 
overall  evaluation  of  performance. 

5.  Scheduling  Of  The  Evaluation  Process 

The  evaluation  process  is  driven  by  the  requirements 
of  OMB  Circular  A-123.   It  directs  that  agencies  shall  provide 
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an  annual  statement  to  the  President  and  Congress  by  December 
31.   Scheduling  of  the  process  should  insure  that  the  infor- 
mation required  for  the  statement  is  provided  so  as  to  meet 
this  requirement.   In  the  completion  of  the  evaluation  the 
agency  should  take  into  account  such  things  as  the  cyclical 
nature  of  some  operations,  availability  of  personnel,  con- 
sideration of  classified  activities  and  other  matters  that 
require  similar  forethought.   The  actual  process  of  vulnera- 
bility assessments  and  internal  control  reviews  will  be  dis- 
cussed in  detail  but  it  should  be  pointed  out  that  the  former 
must  be  conducted  at  least  biennially  and  the  latter  on  a 
continuing  basis. 

C.   SEGMENTING  THE  AGENCY 

The  success  of  the  evaluation  of  an  agency's  system  of 
internal  control  is  dependent  on  the  implementation  of  the 
process  throughout  the  agency.   Segmenting  the  agency  into 
components  for  evaluation  and  reporting  purposes  will  insure 
that  implementation.   As  pointed  out  in  the  OMB  guidelines, 
"There  is  no  single  method  to  divide  an  agency  into  components, 
programs,  and  administrative  functions..."  [Ref.  10].   How- 
ever, there  are  fundamental  principles  that  can  be  used  to 
break  an  agency  into  components  and  programs.   This  results 
in  an  inventory  of  these  items  called  assessable  units. 

When  completing  the  inventory  of  assessable  units  things 

to  be  considered  are: 

1)   Does  the  existing  organizational  structure  provide  a 
method  for  dividing  the  agency  into  assessable  units? 
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2)  What  is  the  nature  of  the  agency's  programs  and 
administrative  functions,  how  are  they  sub-divided, 
do  they  cross  organizational  lines  and  what  is 
their  degree  of  independence? 

3)  What  are  the  budget  levels  and  the  amount  of  personnel 
incorporated  in  the  unit? 

All  of  these  are  relevant  to  the  segmenting  process.   How- 
ever, of  unique  importance  is  whether  a  certain  program  or 
function  operates  in  just  one  location  or  many.   In  the  case 
where  they  operate  in  many  locations,  consideration  must  be 
given  to  identifying  either  the  locations  and  then  the  func- 
tions within  that  location,  or  the  functions  first  and  then  the 
locations.   The  method  chosen  is  not  important  as  long  as  it 
provides  for  complete  coverage. 

When  segmenting  an  agency  two  primary  considerations  come 
to  mind.   First,  the  intent  of  the  legislation  is  to  improve 
internal  control  in  the  Federal  Government.   Therefore,  the 
division  of  the  agency  should  go  to  the  lowest  level  of 
responsibility.   This  will  insure  that  those  personnel  that 
actually  perform  functions  or  administer  programs  will  have 
a  greater  awareness  of  internal  controls  and  their  implemen- 
tation.  Second,  to  comply  with  the  legislation,  the  division 
of  the  agency  must  provide  for  the  systematic  evaluation  of 
and  reporting  on  the  internal  control  system.   This  must  include 
a  provision  for  the  review  of  the  information  gained  by  this 
evaluation  as  it  flows  up  the  organization.   This  allows 
each  level  of  authority  to  evaluate  any  weaknesses  and  to 
determine  if  they  are  unique  to  one  area  or  demonstrate  a 
weakness  that  pervades  their  area  of  responsibility. 
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D.   CONDUCTING  VULNERABILITY  ASSESSMENTS 

Prior  to  the  actual  review  of  internal  controls  in  an 
agency  there  must  be  a  vulnerability  assessment.   This  is 
simply  a  review  of  all  the  programs  and  functions  determined 
in  the  segmenting  process.   The  purpose  of  the  review  is  to 
identify  any  of  these  programs  and  functions  which  are  sus- 
ceptible to  waste,  fraud  and  abuse.   The  vulnerability 
assessment  does  not  evaluate  the  presence  or  effectiveness 
of  internal  controls.   They  are  used  to  determine  the  poten- 
tial for  loss.   An  example  would  be  a  cash  handling  function 
where  large  amounts  of  cash  are  received,  such  as  the  turnover 
of  worn  out  currency  by  banks.   Since  the  value  and  amounts 
are  large,  there  is  a  potential  for  loss  due  to  theft  or 
fraud.   This  potential  would  be  diminished  through  effective 
internal  controls.   However,  the  vulnerability  assessment 
should  only  establish  the  potential. 

Each  agency  must  conduct  their  own  assessment  of  vulnera- 
bility and  the  responsibility  for  this  is  with  management. 
Although  personnel  within  the  agency  who  perform  audit  functions 
can  be  used  for  technical  advice  and  consultation,  the  actual 
work  should  be  performed  by  all  levels  of  management  including 
the  lowest  possible  responsibility  level  as  determined  in  the 
segmenting  process.   There  are  three  steps  in  the  performance 
of  a  vulnerability  assessment  which  will  be  covered  in  the 
following  paragraphs. 
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1.   Analysis  Of  General  Control  Environment 

The  vulnerability  of  a  program  or  function  to  fraud, 
waste  and  abuse  are  influenced  in  a  large  part  by  the  environ- 
ment of  the  activity.   This  environment  is  created  by  several 
inherent  factors  within  an  agency,  including: 

1)  The  attitude  of  management  concerning  the  use  of 
internal  control  systems  within  their  activity  and 
the  communication  of  that  attitude  to  employees. 

2)  The  structure  of  the  organization.   It  should  provide 
for  proper  evaluation  and  reporting  of  programs  and 
functions  to  insure  good  control. 

3)  Personnel  should  be  competent  in  their  assigned  duties 
and  maintain  a  high  level  of  integrity. 

4)  There  should  be  delegation  of  authority  within  an 
organization  that  also  provides  the  requisite  responsi- 
bility and  that  authority  and  responsibility  should 

be  communicated  to  all  cognizant  personnel. 

5)  The  policies  and  procedures  of  the  organization  and 
its  activities  must  be  spelled  out  through  directives, 
standard  operating  procedures  and  the  like  to  insure 
compliance . 

6)  The  budgeting  and  reporting  procedures  used  should 
reflect  organizational  goals  and  the  level  of  the 
accomplishment  of  those  goals. 

7)  There  should  be  existing  checks  and  balances  within 
the  organization.   These  should  provide  for  financial 
control,  internal  auditing  and  other  management 
controls.   This  is  not  an  evaluation  of  controls  but 
just  the  fact  that  they  exist. 

The  evaluation  of  the  general  control  environment 

should  be  carried  out  throughout  the  agency.   This  can  be 

performed  for  the  agency  as  a  whole  or  for  separate  activities, 

programs  and  functions.   The  breakdown  is  determined  by  the 

size,  nature  and  centralization  of  the  area  being  evaluated. 
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In  any  case,  the  evaluation  should  be  conducted  by  consider- 
ing the  policies  and  procedures  used  in  the  area,  interviews 
with  management  and  personnel,  actual  observation  and  the 
familiarity  of  the  reviewer  with  the  operation. 
2 .   Analyses  Of  Inherent  Risk 

Following  the  evaluation  of  the  general  control 
environment  each  program  and  administrative  program  identi- 
fied in  the  segmenting  process  should  be  analyzed  for  its 
inherent  potential  risk  for  fraud,  waste  and  abuse.   This 
is  needed  as  programs  or  functions  of  high  risk  naturally 
require  more  control  than  those  with  low  risk.   The  factors 
that  should  be  considered  include: 

1)  Purpose  and  characteristics  of  the  program  or  function. 
Are  they  documented  by  directive,  instruction,  etc., 
and  are  they  followed?   Are  there  any  aspects  that  lead 
to  a  higher  risk? 

2)  The  budget  allocated  to  the  program  or  function.  If 
the  level  of  funding  or  resources  (such  as  personnel 
and  property)  is  high,  there  is  a  higher  risk  involved. 

3)  Impact  of  the  program  or  function  outside  the  agency. 
Many  programs  or  functions  of  the  agency  involve  the 
public.   A  good  example  is  the  Social  Security  Program. 
This  impact  should  be  considered  in  evaluating  the 
risk. 

4)  Age  and  expected  life  of  the  program  or  function. 
Stable  programs  are  generally  less  susceptible  to  risk. 
New,  changing,  or  programs  being  phased  out  have  a 
higher  risk  due  to  the  environment  of  change  they  are 
in. 

5)  The  degree  of  centalization  of  the  program  or  function. 
Is  the  level  of  centralization  (or  decentralization) 
appropriate  for  the  activity  involved? 

6)  Any  special  concerns  of  the  program  or  function. 
Special  attention  received  by  an  activity  from  the 
President,  Congress,  OMB,  agency  heads  could  indicate 
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a  higher  risk  level.   Also,  attention  from  the  press, 
pending  litigation  and  any  other  special  considerations 
should  be  evaluated  for  their  impact  on  an  activities 
potential  for  fraud,  waste  and  abuse. 

7)  Prior  reviews  that  may  have  been  conducted  of  the 
program  or  function.   Areas  of  vulnerability  may 
already  have  been  uncovered  by  other  audits  such  as  GAO, 
Inspector  General,  etc.   If  an  activity  receives  little 
audit  coverage  or  audits  often  result  in  disclosure 

of  irregularities,  then  it  may  be  more  susceptible  to 
risk. 

8)  The  management  responsiveness  within  the  program  or 
function.   Does  management  respond  promptly  and  effec- 
tively to  audit  findings?   An  activity  where  this  is 
not  the  case  should  be  considered  a  higher  risk. 

9)  Any  other  factors  considered  to  be  significant. 
3 .   Preliminary  Evaluation  Of  Safeguards 

The  final  step  in  the  assessment  of  vulnerability  is 
a  judgment  by  the  reviewer  on  the  existence  and  adequacy 
of  internal  controls.   This  is  not  a  comprehensive  review 
but  an  evaluation  based  on  the  knowledge  of  the  control  system 
gained  during  the  initial  steps.   Of  primary  importance  is 
whether  appropriate  controls  are  operating  to  prevent  or 
minimize  waste,  fraud  and  abuse. 

The  results  of  the  vulnerability  assessment  should  be 
summarized  and  documented  to  provide  an  overall  evaluation  of 
a  program  or  functions  vulnerability.   The  assessment  should 
conclude  whether  a  program  is  high,  moderate  or  lacking  in 
vulnerability.   This  information  is  used  to  develop  a  plan 
for  the  internal  control  review  process. 
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E.   CONDUCTING  INTERNAL  CONTROL  REVIEWS 

The  process  of  evaluating  internal  control  systems  des- 
cribed so  far  is  performed  in  preparation  for  the  internal 
control  review.   This  review  is  an  in-depth  examination  of  the 
system  of  internal  controls  (or  lack  of)  that  operate  in  the 
programs  or  functions  identified  in  the  vulnerability  assess- 
ment.  This  review  confirms  that  internal  controls  are  in 
place,  operating  properly  and  in  a  cost-effective  manner. 
The  review  is  conducted  using  a  six-step  process  detailed  in 
the  following  paragraphs. 

1 .   Identification  Of  Event  Cycles 

In  this  step,  the  programs  and  functions  identified 
in  the  vulnerability  assessment  are  broken  down  into  their 
event  or  transaction  cycle.   An  event  cycle  is  the  process 
that  is  used  to  accomplish  the  various  objectives  of  a  program 
or  function.   Most  will  have  many  event  cycles.   An  example 
of  a  procurement  program  event  cycle  would  include  advertising 
for  copetitive  bids,  protection  of  sealed  bids  prior  to  open- 
ing, evaluation  of  bids  received  and  awarding  of  the  contract 
in  accordance  with  applicable  regulations.   Additional  cycles 
would  follow  the  completion  of  the  contract,  progress  payments, 
etc.   An  administrative  function  example  would  be  a  payroll 
department.   Beginning  with  proper  authorization  of  employment, 
pay  computed  using  only  valid  time  cards,  proper  deduction 
for  Federal  and  State  taxes,  separation  of  duties  for  per- 
sonnel processing  checks  and  those  distributing  them. 
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Each  event  cycle  represents  an  area  that  should  be 
examined  for  internal  controls.   Once  all  event  cycles  are 
identified  in  a  program  or  function,  they  should  be  evaluated 
for  their  vulnerability  to  risk.   This  is  accomplished  using 
the  information  obtained  in  the  vulnerability  assessment  and 
the  judgment  of  the  reviewer.   If  possible,  all  cycles  iden- 
tified should  be  reviewed  but  the  highest  priority  rests  with 
those  considered  most  vulnerable.   As  with  all  the  process 
steps,  good  documentation  should  be  maintained. 

2 .  Analysis  Of  The  General  Control  Environment 

The  environment  in  which  the  internal  controls  to  be 
reviewed  operate  plays  a  key  role  in  their  effectiveness. 
The  analysis  that  is  performed  in  the  vulnerability  assessment 
is  used  for  this  step  but  should  be  updated  to  reflect  the 
current  situation. 

3 .  Documentation  Of  Event  Cycles 

In  order  for  a  reviewer  to  understand  the  process 
involved  in  each  event  cycle  complete  documentation  of  the 
cycle  is  essential.   This  is  especially  true  where  personnel 
completing  the  documentation  and  those  performing  the  review 
are  not  the  same.   The  understanding  of  the  event  cycle  is 
gained  by  interviews  with  the  personnel  performing  the  cycle, 
review  of  policies  and  procedures  followed  and  examination 
of  the  records,  forms  and  reports  maintained.   The  documen- 
tation of  the  cycle  can  be  in  the  form  of  a  narrative  report 
or  a  flowchart  of  the  process  with  pertinent  comments.   In 
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either  case  the  finished  documentation  should  be  reviewed 
with  actual  personnel  performing  the  cycle  to  assure  that 
it  reflects  the  cycle  correctly.   If  necessary  to  evaluate 
the  documentation  a  few  transactions  can  be  traced  through 
the  cycle.   In  subsequent  reviews  the  documentation  from  prior 
reviews  may  be  used,  but  it  must  be  updated  each  time. 
4 .   Evaluation  Of  Internal  Controls 

Using  the  documentation  of  event  cycles  from  the 
previous  step  the  internal  control  system  (as  understood) 
is  evaluated  to  ascertain  if  it  fulfills  the  requirements 
established  by  the  Federal  Managers'  Financial  Integrity  Act 
and  OMB  Circular  A-123.   These  include: 

1)  Reasonable  assurance  that  obligations  and  costs  are 
in  compliance  with  applicable  law. 

2)  Agency  funds,  property  and  other  assets  are  properly 
safeguarded. 

3)  Revenues  and  expenditures  are  properly  recorded  to 
permit  the  preparation  of  reliable  financial  and 
statistical  information. 

The  first  step  of  this  evaluation  is  to  define  the  control 

objectives  for  each  event  cycle.   Control  objectives  are 

defined  in  Chapter  II  but  basically  consist  of  the  purpose 

the  control  system  or  mechanism  is  meant  to  accomplish.   These 

objectives  should  be  documented  and  reviewed  to  establish  the 

objectives  for  each  cycle  are  complete,  relevant  and  make 

sense. 

After  the  objectives  for  an  event  cycle  have  been 

defined  the  documentation  is  reviewed  to  establish  the 
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presence  (or  lack  of)  control  techniques.  Control  techniques 
are  defined  in  Chapter  II  but  basically  are  the  processes  or 
documents  which  enable  the  control  objectives  to  be  met.  As 
always  proper  documentation  of  the  control  techniques  is  re- 
quired. This  documentation  is  reviewed  to  determine  if  the 
control  techniques  incorporated  provide  reasonable  assurance 
that  the  control  objectives  are  met. 

The  inherent  risks  in  an  event  cycle,  the  control 
objectives  and  control  techniques  form  an  inseparable  relation- 
ship.  A  very  good  example  is  a  cycle  for  accounts  payable. 
An  inherent  risk  in  this  cycle  would  be  the  payment  of  in- 
voices for  goods  not  received.   The  control  objective  would 
be  that  accounts  would  only  be  paid  after  receipt  and  inventory 
of  goods.   The  control  techniques  that  would  insure  that  the 
objective  is  meant  would  include  receiving  and  inspection 
reports  which  the  accounts  payable  department  would  receive 
and  compare  with  vendor  invoices  prior  to  payment.   Proper 
separation  of  the  duties  of  receiving  goods  and  paying  for 
invoices  would  also  be  an  appropriate  technique  in  this 
example. 

The  final  results  of  the  evaluation  of  internal  con- 
trols should  identify  those  that  require  testing,  the  absence 
of  controls  that  should  be  corrected  and  excessive  or  unneces- 
sary controls  that  could  be  eliminated. 
5 .   Testing  Of  Internal  Controls 

In  the  review  process  the  final  step  is  the  testing 
of  those  controls  identified  in  the  evaluation  to  determine 
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if  they  are  functioning  as  required.   The  primary  testing  of 
internal  controls  is  the  selection  of  a  sample  of  transactions 
(generally  by  statistical  methods)  and  then  following  the 
documentation  of  each  transaction  to  ascertain  its  compliance 
with  the  internal  control  in  question.   In  addition,  obser- 
vations of  controls  functioning  and  interviews  of  personnel 
involved  can  be  useful.   When  control  techniques  being  tested 
appear  to  be  inadequate  or  non- functional ,  an  evaluation  of 
personnel  performing  the  cycle  should  be  made  to  determine  if 
they  are  compensating  for  the  control  weakness.   Other  tech- 
niques also  might  compensate  for  the  control  in  question. 
The  review  should  provide  documentation  for  any  control  weak- 
nesses that  were  uncovered  and  possible  corrections  for  them. 
6 .   Reporting  The  Results  Of  Internal  Control  Reviews 
After  completion  of  the  review  of  internal  controls 
the  results  must  be  summarized  and  reported  on.   There  are 
two  reports  that  are  required.   The  first  report  is  designed 
to  provide  management  of  the  program  or  function  with  infor- 
mation concerning  control  weaknesses  uncovered  and  possible 
corrective  action  to  be  taken.   The  second  report  is  designed 
to  provide  the  agency  head  with  information  for  the  preparation 
of  the  annual  statement  to  the  President  and  Congress.   This 
report  will  include  the  fact  that  the  internal  control  review 
was  conducted  and  any  material  weaknesses  uncovered. 

F.   CONCLUSION 

The  guidelines  for  the  evaluation  of  internal  control 
systems  provided  by  OMB  are  complete  through  the  review 
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process.   Personnel  who  have  received  training  in  internal 
control  reviews  should  be  able  to  implement  them.   However, 
the  guidelines  do  not  provide  for  the  evaluation  of  control 
weaknesses  in  regard  to  materiality.   This  area  will  be 
covered  in  the  following  chapters. 
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IV.       THE    CONCEPT    OF   MATERIALITY 

A.  INTRODUCTION 

After  the  system  of  internal  controls  has  been  evaluated, 
and  any  weaknesses  uncovered,  a  determination  must  be  made  as 
to  the  materiality  of  the  weakness.   This  is  required  so  the 
agency  head  can  report  to  the  President  and  Congress  on  his/ 
her  system  of  internal  control  in  their  annual  report.   How- 
ever, this  is  much  easier  said  then  done.   The  primary  obsta- 
cle to  this  determination  is  the  lack  of  clear  guidelines  as 
to  what  constitutes  a  material  weakness.   This  chapter  will 
examine  the  concept  of  materiality  both  in  the  private  sector, 
and  in  the  Federal  Government.   Finally,  an  attempt  to  inte- 
grate these  two  concepts  will  be  made. 

B.  THE  ILLUSIVE  CONCEPT 

The  Random  House  College  Dictionary  defines  something  that 
is  material  as  "of  substantial  import;  of  much  consequence; 
important..."  [Ref.  11].   This  is  a  broad  definition,  but  pro- 
vides no  insight  on  how  to  apply  the  concept.   The  problem 
lies  not  in  the  definition,  but  in  the  application.   To  para- 
phrase a  U.S.  Supreme  Court  Justice's  comment  on  obscenity, 
"We  can't  define  materiality,  but  we  know  it  when  we  see  it." 
It  is  clear  that  something  that  is  material,  is  important, 
but  to  whom? 

A  simple  example  illustrates  that  everyone  has  a  different 
concept  of  what  is  material.   A  poor  man  walking  down  a  sidewalk 
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spots  a  five  dollar  bill.   The  man,  knowing  it  will  put  food 
on  the  table,  quickly  grabs  it,  and  stuffs  it  in  his  pocket. 
To  this  man,  five  dollars  and  possibly  less  is  very  material. 
Another  man,  this  one  wealthy  from  an  inheritance  might  pass 
this  five  by.   Indeed,  he  might  use  five  dollar  bills  to 
light  his  cigars.   To  this  man,  five  dollars  is  immaterial. 
Now  let's  go  back  to  the  first  man,  only  instead  of  being 
poor,  imagine  that  he  has  taken  a  vow  against  materialism  and 
lives  in  proverty  by  choice.   This  man  may  well  pass  the  five 
dollars  by  as  money  is  immaterial  to  him.   Finally,  imagine 
that  the  wealthy  man  became  so  by  working  his  way  up  from 
nothing.   Since  this  man  knows  the  value  of  a  dollar,  he  will 
scoop  the  bill  from  the  sidewalk  even  though  the  five  dollars 
is  insignificant  relative  to  his  personal  fortune.   In  this 
one  example  we  can  observe  four  quite  different  interpretations 
of  materiality. 

From  the  simple  example  of  the  five  dollar  bill  we  can 
see  that  materiality  is  subject  to  judgment.   In  this  example 
the  element  being  evaluated  was  money.   Even  though  it  could 
be  quantified  in  amount  and  its  value  known  (in  spending 
power) ,  each  person  evaluated  its  materiality  from  a  differ- 
ent viewpoint.   The  materiality  of  the  five  dollar  bill  could 
not  be  ascertained  without  knowing  the  personal  value  each 
person  placed  on  it.   By  itself,  the  five  dollar  bill  had  no 
indication  of  its  materiality. 
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It  is  this  personal  judgment,  a  necessary  requirement  to 
make  decisions  of  materiality,  that  makes  it  an  illusive 
concept.   In  financial  accounting,  the  materiality  concept 
has  basically  two  applications.   One  involves  the  content  of 
financial  statements,  while  the  other  is  concerned  with  the 
auditing  of  internal  controls.   Each  of  these  meanings  will 
be  examined  in  the  following  paragraphs. 

C.   MATERIALITY  IN  PRIVATE  SECTOR  FINANCIAL  STATEMENTS 

On  an  annual  basis  most  businesses  in  the  private  sector 
are  required  to  prepare  statements  of  their  assets  and  liabili- 
ties (Balance  Sheet),  revenue  and  expenses  (Income  Statement) 
and  other  statements  to  provide  information  on  the  state  of 
their  business.   These  statements  are  collectively  called  the 
financial  statements  of  a  business.   After  the  preparation  of 
statements,  many  businesses  undergo  an  audit  by  a  Certified 
Public  Accountant  (CPA)  in  order  to  verify  the  validity  of 
their  financial  statements.   This  is  done  to  satisfy  many 
different  parties  including  investors,  creditors,  boards, 
Federal  and  State  agencies,  etc.   The  goal  of  the  CPA  in  his 
or  her  audit,  is  to  determine  if  the  financial  statements 
fairly  present  the  financial  position  of  the  business  for 
the  period  that  they  represent.   One  of  the  major  concerns 
of  the  CPA  in  regard  to  an  audit  of  financial  statements 
is  that  there  are  not  any  misstatements  in  the  audited 
financial  statements  that  would  be  considered  material.   How- 
ever, the  problem  of  what  constitutes  a  material  misstatement, 
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to  whom  it  is  material  and  what  effect  the  misstatement  will 
have  are  not  easily  solved. 

1 .  Users  Of  Financial  Statements 

The  ultimate  party  that  uses  the  information  con- 
tained in  financial  statements  should  determine  what  consti- 
tues  a  material  misstatement.   As  pointed  out  in  Arthur  Ander- 
sen and  Company's  Objectives  of  Financial  Statements  for 
Business  Enterprises: 

Financial  statements  are  for  users — not  directly  for 
preparers,  and  certainly  not  for  auditors.   But,  who 
are  the  users?   What  do  they  want?   And  what  do  they  have 
a  right  to  expect  from  financial  statements?   [Ref.  12] 

The  job  of  the  CPA  then,  in  performing  the  audit,  is  to  con- 
sider the  end  users  and  set  the  level  of  materiality  accordingly. 
In  a  business  that  is  privately  held  (no  stock  is  bought  or 
sold  outside  of  the  company) ,  this  level  would  be  indicated  by 
the  Board  of  Directors,  regulatory  agencies  and  creditors. 
In  a  publicly  held  company,  the  investors  and  potential  inves- 
tors in  the  business  would  also  indicate  the  level  of  materiality 
to  be  considered. 

2 .  Information  Required  By  Users  Of  Financial  Statements 
Once  the  users  of  the  financial  statements  have  been 

identified,  the  CPA  can  determine  what  information  they  need. 
In  the  case  of  creditors,  their  primary  interest  is  the  ability 
of  the  business  to  repay  their  debts.  On  the  other  hand,  the 
investor  is  looking  for  a  return  on  their  investment.  Boards 
of  Directors  are  assessing  the  performance  of  the  officers  of 
the  business  while  regulatory  agencies  are  concerned  that  the 
business  is  in  compliance. 
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Each  user  of  the  financial  statement  is  concerned 
with  their  own  interests.   While  some  users  are  trained  in 
accounting  principles  and  have  the  financial  expertise  to 
properly  evaluate  financial  statements,  many  (primarily  small 
investors)  have  limited  knowledge  in  these  areas.   The 
Securities  and  Exchange  Commission  has  defined  the  materiality 
of  information  for  investors  as  that  information  "required 
to  those  matters  about  which  an  average  prudent  investor 
ought  reasonably  to  be  informed"  [Ref.  13].   Unfortunately, 
words  like  "average,"  "prudent"  and  "reasonable"  are  just  as 
ambiguous  as  what  they  are  meant  to  define. 

If  the  financial  statements  include  the  information 
that  the  average  investor  or  user  needs,  then  a  misstatement 
in  that  information  that  would  be  material  would  be  such  that 
the  user  would  make  an  incorrect  decision  based  on  that  infor- 
mation.  In  addition,  the  mistake  would  have  a  material  conse- 
quence to  the  user.   For  example,  financial  statements  which 
overstate  assets  might  cause  a  creditor  to  loan  more  money 
to  a  business  than  they  can  provide  security  for.   If  that 
business  subsequently  goes  bankrupt,  and  the  creditor  can 
not  recover  the  value  of  its  loan  because  the  assets  were 
overstated,  then  the  misstatement  was  clearly  material.   Thus, 
the  information  that  users  require,  is  that  which  allows  them 
to  make  decisions  regarding  the  business,  with  reliability 
that  the  information  is  accurate  enough  to  preclude  incorrect 
decisions. 
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3.   Standards  Of  Materiality  In  Financial  Statements 
The  financial  statements  of  a  business  report  on 
financial,  external  and  internal  aspects  of  the  business. 
These  aspects  are  reflected  in  the  actual  numbers  and  amounts 
presented,  footnote  disclosures  and  the  opinion  of  the  CPA. 
The  standards  for  what  represents  materiality  in  the  financial 
statements  are  set  by  the  nature  and  interrelationship  of 
these  aspects  coupled  with  the  user  requirements.   The  follow- 
ing will  illustrate  the  financial,  external  and  internal 
aspects  through  actual  cases, 
a.   Financial  Aspects 

The  financial  aspects  of  financial  statements  are 
the  actual  accounts  presented  in  the  statements  and  their 
interrelationship.   The  standard  for  materiality  in  these 
accounts  varies  depending  on  the  size  of  the  business.   It 
should  be  obvious  that  a  large  firm  would  not  consider  the 
same  dollar  amount  to  be  material  that  a  small  one  would.   For 
this  reason,  percentages  of  some  base,  are  normally  used  to 
establish  the  degree  of  materiality.   In  many  cases  the 
percentage  is  varied  based  on  what  type  of  account  is  being 
looked  at.   For  example,  the  income  statement  could  be  evalu- 
ated on  the  basis  of  what  percentage  of  income  the  deviation 
in  an  account  represented.   A  case  from  the  not  too  distant 
past  highlights  this  aspect. 

The  Rockwell  International  Corporation  suffered 
substantial  losses  through  a  computer  leasing  fraud  they 
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entered  into  with  OPM  Leasing  Services.   The  losses  were  not 
revealed  in  Rockwell's  annual  financial  statements  because 
they  were  deemed  immaterial.   At  the  time  the  assets  of  Rock- 
well amounted  to  7.4  billion  dollars.   It  was  reported  that 
the  company's  auditors  (Deloitte,  Haskins  &  Sells)  had  stated 
that  fraud-related  losses  might  not  be  considered  material  if 
they  were  less  than  10  percent  of  shareholder  equity.   In 
Rockwell's  case,  this  meant  that  the  loss  could  go  as  high  as 
220  million  dollars. 

Although  the  amount  indicated  as  being  immaterial 
in  the  Rockwell  case  most  likely  would  boggle  the  mind  of 
the  average  investor,  this  type  of  determination  continues 
to  be  made  on  a  regular  basis.   Underlying  this  is  the  concept 
that  the  business  is  an  ongoing  concern.   If  a  company  can 
sustain  a  loss  similar  to  this  and  maintain  normal  operations, 
it  probably  is  immaterial. 

b.   External  Aspects 

Every  business  is  affected  by  the  environment  it 
finds  itself  in.   Some  factors  of  that  environment  the  business 
can  control.   These  include  the  type  of  industry  that  they 
operate  in,  marketing  area  and  the  like.   Other  factors  are 
not  under  the  control  of  the  business.   These  include  govern- 
ment regulations,  market  response,  competition  and  the  like. 
Any  of  these  factors  can  and  do  impact  on  the  company  and 
should  be  reflected  in  the  financial  statements  if  they  are 
material.   In  some  cases  these  factors  would  be  disclosed  by 
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footnotes  to  the  financial  statements.   An  example  would  be 
a  change  in  depreciation  method  that  could  change  the  income 
(or  loss)  of  the  business.   Some  factors  require  adjustment 
of  account  balances,  such  as  an  adjustment  for  a  loss  in 
the  value  of  inventory.   Where  a  factor  exists  that  creates 
a  potential  liability  for  the  business,  such  as  a  pending 
lawsuit,  the  establishment  of  a  liability  account  is  required. 

The  following  case  provides  a  good  example  of  the 
effect  of  external  factors  on  a  business.   In  the  early  seven- 
ties there  was  a  tremendous  boom  in  the  sale  of  Citizen's 
Band  (CB)  radios.   Many  companies  (both  established  and  new 
ones)  rushed  into  production  to  meet  the  demand  for  these 
radios.   One  such  company,  Hy-Gain,  was  extremely  successful 
in  this  regard.   For  a  few  years  business  was  quite  good, 
profits  were  made  and  inventory  stockpiled.   Then  the  Federal 
Communications  Commission  (FCC)  surprised  the  industry  by 
announcing  the  implementation  of  17  new  channels. 

With  the  advent  of  new  40  channel  CB  radios,  Hy- 
Gain  was  faced  with  a  large  inventory  of  potentially  unmarketable 
23  channel  radios.   At  least  that  was  the  position  taken  by 
the  manager  in  charge  of  their  annual  audit  by  Touche  Ross 
&  Company.   She  believed  that  the  market  for  23  channel  CB 
radios  was  so  limited,  that  the  inventory  of  Hy-Gain  should 
be  substantially  marked  down.   The  management  of  Hy-Gain, 
understandably  concerned  about  how  investors  and  creditors 
would  react  to  this  move,  argued  against  it.   They  insisted 
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that  the  23  channel  radios  could  be  marketed  at  close  to  full 
value.   In  the  end,  management  convinced  the  audit  partner 
to  follow  their  lead  and  there  was  no  write  down.   Subsequent 
to  this,  the  market  for  23  channel  CB  radios  collapsed  and 
Hy-Gain  along  with  it. 

In  this  case,  the  external  factors  of  regulation 
and  market  response  combined  to  cause  a  material  impact  on 
the  financial  statements.   However,  because  management  inter- 
preted the  effect  of  the  regulation  to  be  immaterial  (or 
wanted  it  to  be),  the  financial  statements  were  misstated. 
The  auditors  were  not  held  accountable  for  failing  to  state 
the  materiality  of  the  situation.   This  is  because  the  factor 
that  caused  the  misstatement,  the  market  response,  was  external 
and  in  truth,  could  not  be  predicted  reliably.   The  private 
sector  recognizes  that  some  degree  of  uncertainty  cannot  be 
eliminated. 

c.   Internal  Aspects 

The  information  reflected  in  the  financial  state- 
ments of  a  business  quite  often  are  affected  by  factors  from 
within  the  business.   These  could  include  accounting  practices, 
management  attitude  and  especially  internal  controls.   Changes 
in  accounting  practices  usually  are  reflected  in  footnotes  to 
the  financial  statements  and  include  their  impact  on  account 
balances.   However,  the  attitude  of  management  normally  is 
not  reflected  in  the  financial  statements.   This  is  because 
they  reflect  the  financial  position  of  the  firm  and  not  its 
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direction  or  potential.  Internal  controls  are  also  not  re- 
flected directly  in  the  financial  statements,  but  do  play  a 
very  important  role  in  the  CPA  audit,  which  will  be  covered 
later. 

The  impact  of  internal  factors  on  a  business  can 
be  significant,  as  the  following  case  points  out.   Very 
recently,  the  scandalous  conduct  of  the  top  executives  of 
Frigitemp  has   been  revealed.   These  executives  actually  de- 
frauded their  own  corporation,  their  CPA  (Arthur  Andersen  & 
Company),  other  corporations  and  the  Federal  Government.   Through 
the  collusion  of  other  executives,  bribes  to  officials  of 
other  corporations  and  extremely  clever  defalcation  schemes, 
the  executives  at  Frigitemp  were  able  to  practice  their  fraud 
for  some  time.   This  resulted  in  the  absence  of  relevant  and 
material  information  from  the  financial  statements  of  Frigitemp. 
In  fact,  the  company  went  bankrupt  as  a  result  of  the  fraud. 
Indeed,  it  was  bankruptcy  which  finally  brought  their  conduct 
to  light. 

This  case  brought  several  questions  to  light,  such 
as  what  responsibility  do  the  CPA's  have  to  uncover  fraud 
such  as  this.   The  answers  will  be  decided  in  the  courtroom 
and  in  Congress.   However,  it  does  highlight  the  fact  that 
internal  factors  can  be  very  material  to  the  financial 
statements . 

From  the  previous  paragraphs,  we  can  conclude  that 
the  definition  of  what  is  material  to  the  financial  statements 
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of  a  business  is  the  subject  of  much  confusion.   In  an  audit 
of  financial  statements,  the  deciding  factor  rests  with  the 
judgment  of  the  CPA.   However,  the  CPA  must  keep  in  mind  that 
should  his  or  her  judgment  be  questioned,  the  courts  may  be 
called  upon  to  decide.   Even  though  there  has  been  much  dis- 
cussion in  the  accounting  profession  about  the  need  for  official 
guidelines  for  materiality,  none  have  been  forthcoming.   This 
is  primarily  because  of  the  inability  to  quantify  many  dis- 
similar entities  into  set  standards.   The  CPA  is  educated, 
trained  and  experienced  in  evaluating  the  materiality  of  infor- 
mation within  the  financial  statements.   They  (CPA's)  must 
make  judgments  on  materiality  and  be  liable  for  them. 

Although  the  CPA's  have  been  making  judgments  on 
materiality  for  many  years  their  performance  has  recently 
come  under  attack  in  Congress.   In  an  interview  published  in 
Management  Accounting,  Representative  John  D.  Dingell  was 
quoted  as  saying: 

I'm  not  sure  whether  the  public  perception  of  the 
narrowness  of  the  accountants '  responsibility  is  the 
same  as  the  accountants ' .   The  accountants  say  they  cannot 
catch  fraud.   We  found  some  instances  where  we  can 
reasonably  believe  that  accountants  in  the  ordinary 
exercise  and  skills  of  their  trade,  or  just  reasonable 
prudence,  should  have  uncovered  fraud... I  find  it  very 
curious,  for  example,  that  one  day  a  corporation  gets 
a  clean  bill  of  health  and  within  one  or  two  days  there- 
after it  collapses...  [Ref.  14] 

There  is  a  growing  feeling  in  Congress  that  the  CPA's  should 
be  held  accountable  for  more  than  the  verification  of  the 
fairness  of  the  financial  statements  in  their  audits.   Empha- 
sis in  areas  such  as  the  operational  control  (management)  of 
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the  business  would  be  new  for  the  CPA's  and  would  require  a 
shift  in  their  perception  of  materiality. 

D.   MATERIALITY  IN  PRIVATE  SECTOR  AUDITING 

While  the  auditor  is  ultimately  concerned  with  the 
financial  statements  and  their  fair  presentation  of  the 
financial  position  of  the  business,  they  have  different  view- 
points while  conducting  their  audit.   This  is  because  situations 
which  would  not  be  material  individually  to  the  financial 
statements  may  result  from  a  larger  problem  that  would. 
Therefore,  the  auditor  must  consider  materiality  in  evaluations 
of  internal  control,  compliance  testing,  audit  procedures  and 
the  like.   Every  aspect  of  the  audit  must  be  consisered  for 
its  materiality. 

The  auditor  is  concerned  with  many  aspects  of  materiality 
in  the  conduct  of  the  audit.   These  include  the  financial, 
external  and  internal  aspects  mentioned  before,  as  well  as 
economic,  legal,  psychological  and  philosophical  aspects. 
Given  the  nature  of  these  aspects,  it  appears  that  the 
materiality  in  auditing  is  also  hard  to  define.   Indeed, 
in  an  article  of  the  Journal  of  Accountancy  on  guidance  for 
auditors  the  authors  wrote: 

It  is  unlikely  that  reliance  on  simple  rules  of  thumb 
such  as  some  percentage  of  income  or  some  percentage 
of  any  other  financial  disclosure  will  lead  to  truly 
professional  materiality  judgments  in  specific  audit 
situations.   [Ref.  15] 

Although  by  no  means  a  concise  guide  to  materiality 

decisions,  the  Auditing  Standards  Board  of  the  American 
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Institute  of  Certified  Public  Accountants  has  recently  re- 
leased a  new  statement  on  materiality  in  auditing.   It 
includes  guidance  for  materiality  in  the  conduct  of, 
planning  for,  and  the  evaluation  of  an  audit. 
1 .   Materiality  In  Conducting  An  Audit 

The  recent  Statement  on  Auditing  Standards  (SAS) 
number  4  7  [Ref .  16] ,  provides  guidance  to  the  auditor  on 
materiality  when  conducting  an  audit.   The  SAS  includes 
comment  on  what  is  termed  "audit  risk".   The  meaning  of  audit 
risk  is  derived  from  the  fact  that  the  auditor  gives  his  or 
her  opinion  on  the  financial  statements  of  a  business. 
Therefore,  the  auditor  has  a  risk  that  the  audit,  and  the 
opinion  given  based  on  that  audit,  might  not  reveal  a  material 
misstatement.   Accordingly,  the  auditor  must  evaluate  each 
potentially  material  deviation  in  the  audit  in  relation  to 
its  impact  on  his  or  her  audit  risk. 

The  auditor's  primary  goal  in  performing  the  audit 
is  to  satisfy  him/herself  that  the  financial  statements  are 
fairly  presented  in  accordance  with  generally  accepted 
accounting  principles  (GAAP) .   This  occurs  if  the  statements 
taken  as  a  whole  are  not  materially  misstated,  by  errors  or 
irregularities  which  might  individually  or  in  the  aggregate 
result  in  misinformation.   These  errors  consist  of  misappli- 
cations of  GAAP,  departures  from  fact,  or  necessary  information 
being  omitted. 
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While  performing  the  audit,  the  auditor  should  con- 
sider the  nature  and  amount  of  both  the  errors  and  irregu- 
larities detected  as  well  as  the  item  being  examined  and 
their  relation.   Based  on  the  auditor's  perception  of  user 
needs  and  his  or  her  professional  judgment,  determinations  of 
materiality  can  be  made  in  light  of  the  surrounding  circum- 
stances.  It  should  be  recognized  that  these  decisions  involve 
both  quantitative  and  qualitative  factors.   As  pointed  out 
in  SAS  Number  47: 

...errors  of  relatively  small  amounts  detected  by  the 
auditor  could  have  a  material  effect  on  the  financial 
statements.   For  example,  an  illegal  payment  of  an 
otherwise  immaterial  amount  could  be  material  if  there 
is  a  reasonable  possibility  that  it  could  lead  to  a 
material  contingent  liability  or  a  material  loss  of 
revenue.   [Ref.  17] 

The  basic  guidance  is  that  materiality  decisions  should  be 
made  based  on  an  understanding  of  the  situation  using  pro- 
fessional judgment. 

2  .   Planning  The  Audit 

In  an  audit  of  a  business,  the  auditor  first  considers 
materiality  and  audit  risk  when  planning  for  the  audit.   This 
is  especially  true  in  light  of  the  inverse  relationship  be- 
tween audit  risk  and  materiality.   For  example  if  the  account 
or  transaction  cycle  being  evaluated  has  a  low  risk  of  a 
large  material  misstatement,  it  could  have  a  high  risk  of  a 
small  misstatement.   Therefore,  all  things  being  equal,  a 
decrease  in  either  the  level  of  acceptable  risk  or  the  level 
of  materiality  will  result  in  a  need  for  additional  audit 
planning . 
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The  planning  that  the  auditor  does  for  the  audit 
centers  around  the  collection  of  sufficient  evidence  to 
evaluate  the  financial  statements.   To  collect  that  evidence 
he  or  she  must  select  appropriate  audit  procedures  in  light 
of  the  audit  risk  and  materiality  involved.   The  auditor 
must  first  make  a  preliminary  judgment  of  materiality  for 
the  audit  based  on  his  or  her  experience  and  knowledge  of  the 
entity.   The  audit  plan  is  then  developed  with  this  preliminary 
materiality  level  to  provide  the  evidence  required  to  evalu- 
ate the  financial  statements.   The  audit  process  itself  has 
inherent  limitations  that  also  must  be  considered.   Of  primary 
consideration  is  the  desire  for  the  audit  to  be  economically 
useful.   That  is,  performed  in  a  reasonable  amount  of  time 
for  a  reasonable  cost. 

After  consideration  of  the  materiality  for  the  audit 
of  the  financial  statements,  the  auditor  must  consider  what 
level  of  materiality  he  or  she  will  use  in  the  evaluation  of 
specific  accounts,  transactions  or  controls.   This  is  impor- 
tant because  an  error  that  might  not  be  material  individually 
may  be  material  as  the  sum  or  errors  from  other  accounts  , 
transactions  or  controls.   This  will  assist  the  auditor  in 
determining  the  scope  of  audit  procedures  required.   Accord- 
ing to  SAS  47,  there  are  three  risks  that  the  auditor  must 
consider  when  planning  for  the  audit.   These  are  inherent 
risk,  control  risk  and  detection  risk. 

The  inherent  risk  is  the  susceptibility  of  an  account 
or  transaction  type  to  material  error,  when  aggregated  with 
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error  in  other  accounts  or  transaction  types.   Control  risk 
is  the  risk  that  this  same  error  could  occur  and  not  be  pre- 
vented or  detected  by  internal  control  systems.   Where  the 
inherent  risk  is  high,  the  control  risk  should  be  low  and 
vice- versa.   However,  these  risks  are  not  normally  under  the 
control  of  the  auditor.   The  detection  risk  is  under  the 
auditors  control  and  is  the  risk  that  the  procedures  conducted 
in  the  audit,  will  lead  him  or  her  to  believe  that  no  error 
exists,  when  in  fact  it  does.   Therefore,  in  audit  planning 
the  auditor  should  plan  to  lower  his  detection  risk  by  using 
more  effective  audit  procedures  when  the  inherent  or  control 
risk  is  high.   The  converse  is  true  when  inherent  or  control 
risk  is  low. 

Throughout  the  planning  of  the  audit,  the  auditor 
must  continuously  evaluate  his  or  her  level  of  materiality. 
This  evaluation  is  based  on  professional  judgment  taking  into 
account  the  users  of  the  financial  statements .   In  the  final 
analysis,  it  is  the  auditor's  opinion  as  to  whether  the  finan- 
cial position  of  the  business  is  presented  fairly. 
3.   Evaluation  Of  The  Audit 

After  the  conclusion  of  audit  procedures,  the  infor- 
mation obtained  must  be  evaluated  in  light  of  the  materiality 
level.   If  the  errors  detected  (whether  individually  or  in 
aggregate)  are  material  to  the  financial  statement  as  a 
whole,  then  they  must  be  corrected  or  a  qualified  or  adverse 
opinion  must  be  given.   Once  again,  the  errors  must  be 
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evaluated  using  both  quantitative  and  qualitative  considera- 
tions. If  analytical  review  techniques  have  resulted  in  an 
indication  of  error,  the  auditor  should  use  additional  pro- 
cedures to  estimate  the  error.  In  any  case,  where  estimates 
are  used  in  lieu  of  factual  data,  a  determination  should  be 
made  as  to  the  materiality  of  an  error  between  the  estimate 
and  actual. 

Another  area  of  consideration  is  the  likelihood  of 
errors.   That  is,  where  no  errors  have  been  detected,  there 
still  is  a  possibility  of  misstatement  due  to  detection  risk 
Where  this  is  a  concern  after  completion  of  the  audit,  addi- 
tional procedures  should  be  employed  to  lower  the  detection 
risk.   The  final  evaluation  of  the  audit  rests  with  the  audi- 
tor, who  determines  if  he  or  she  has  sufficient  evidence  to 
support  the  financial  statements. 

E.   MATERIALITY  IN  THE  FEDERAL  GOVERNMENT 

Although  the  Federal  Government  maintains  many  audit 
agencies,  both  in  the  Executive  branch  and  the  Legislative 
branch,  as  well  as  at  the  agency  level,  there  is  not  much 
emphasis  on  the  concept  of  materiality.   Indeed,  the  Comp- 
troller General's  book  of  standards  for  governmental  audits 
defines  materiality  as: 

The  concept  which  refers  to  the  significance  of  an 
item  of  information  which  could  appear,  does  appear,  or 
does  not  appear  in  a  financial  statement.   [Ref.  18] 

While  not  unsound,  this  definition  does  not  shed  much  light 

on  what  materiality  means  but  evidently  leaves  that  decision 


to  the  judgment  of  the  auditor.   For  practical  purposes,  most 
governmental  audit  agencies  enjoy  a  reputation  of  considering 
anything  material,  as  they  include  any  weaknesses  uncovered 
in  their  audit  reports.   The  following  section  attempts  to 
use  the  concept  of  materiality  in  the  private  sector  to 
develop  one  for  the  Federal  Government. 

In  the  Federal  Government,  traditional  accounting  con- 
trols can  be  evaluated  for  materiality  in  much  the  same  manner 
as  in  the  private  sector.   The  financial  aspects  of  accounts, 
transactions,  etc.,  can  be  evaluated  using  percentages  of 
some  base.   Likewise,  internal  and  external  aspects  can  be 
evaluated  along  the  lines  of  the  private  sector.   However, 
the  Federal  Government  is  held  to  a  higher  level  of  stewardship 
than  the  typical  private  sector  firm  because  it  serves  the 
public  trust.   This  must  be  remembered  when  considering 
materiality  in  the  evaluation  of  internal  and  administrative 
controls  in  the  Federal  Government.   The  nature  of  the  services 
provided  by  an  agency,  who  is  affected  by  them  and  how,  is 
an  important  aspect  of  this  evaluation. 

1 .   Output  Of  The  Federal  Government 

Most  agencies  of  the  Federal  Government  provide 
services  and  information  which  affect  a  wide  range  of  inter- 
ested parties.   (This  relationship  is  illustrated  by  Figure  1.) 
This  may  be  in  the  form  of  reports  like  the  annual  internal 
control  statement  required  by  the  Federal  Managers'  Financial 
Integrity  Act.   It  may  be  information  used  by  other  agencies, 
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contractors,  reporters,  the  public,  etc.   The  effect  that 
these  services  and  information  have  on  the  interested  parties 
may  be  direct,  indirect,  or  a  combination  of  both.   Several 
examples  of  direct  services  are: 

1)  Delivery  of  mail  by  the  U.S.  Post  Office. 

2)  Entitlement  programs  such  as  Food  Stamps  and  Social 
Security. 

3)  Weather  forecasts  by  the  National  Weather  Service. 

4)  Collection  of  taxes  by  the  Internal  Revenue  Service. 
Some  services  have  both  direct  effects  and  indirect  effects. 
Examples  of  these  are: 

1)  Air  traffic  control  by  the  Federal  Aviation  Agency. 

2)  Control  of  TV  and  radio  broadcasters  by  the  Federal 
Communications  Commission. 

3)  Crime  prevention  by  the  Federal  Bureau  of  Investigation 
Finally,  some  services  are  indirect  in  nature  and  do  not 
generally  have  a  direct  impact  that  is  measurable.   Some 
examples  of  these  are: 

1)  National  Defense  by  the  Department  of  Defense. 

2)  Diplomatic  work  by  the  Department  of  State. 

3)  Monetary  policy  exercised  by  the  Federal  Reserve  Board. 
Whether  direct  or  not,  the  services  and  information  provided 
by  most  agencies  affect  the  parties  that  are  interested  in 
them.   In  order  to  develop  a  concept  of  materiality,  these 
interested  parties,  their  views  and  attitudes  should  be 
considered. 
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2 .  Identifying  Interested  Parties  Of  The  Agency 

In  the  private  sector,  the  users  of  financial  state- 
ment information  affect  the  level  of  materiality  used  in  the 
evaluation  of  those  statements  by  the  auditor.   In  the 
Federal  Government,  the  parties  interested  in  the  agency, 
their  views,  attitudes  and  impact  on  the  agency  should  be 
considred  in  setting  a  level  of  materiality  for  internal 
control  evaluation.   These  interested  parties  include  those 
that  benefit  from  a  service,  special  interest  groups,  audit 
agencies,  the  courts,  other  agencies,  Congress  and  the  Presi- 
dent, to  name  a  few.   In  addition,  since  the  effectiveness  of 
an  agency  may  be  decreased  by  adverse  publicity,  the  news 
media  must  be  considered  an  interested  party.   The  public  at 
large  is  also  an  interested  party,  because  we  live  in  a  demo- 
cratic society  with  a  relatively  unlimited  flow  of  information 
concerning  public  resources. 

3 .  Identifying  The  Impact  On  Interested  Parties 

Once  an  agency  has  defined  the  group  of  interested 
parties  it  affects,  it  can  start  considering  the  impact  of 
the  services  and  information  the  agency  provides  on  them. 
This  is  done  by  evaluating  the  views,  attitudes  and  concerns 
of  the  parties.   Several  examples  of  this  process  follow. 

a.   Parties  Who  Benefit  From  Agency  Services 

Those  parties  which  receive  a  service  from  an 
agency  are  concerned  with  anything  that  limits  or  deprives 
them  of  that  service.   An  example  would  be  the  U.S.  Post 
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Office  and  the  delivery  of  mail.   If  a  weakness  prevented  the 
fulfillment  of  the  mail  delivery  mission,  the  parties  who 
benefit  from  mail  delivery  would  be  concerned. 

b.  Parties  Who  Control  The  Agency 

Every  agency  is  under  the  control  of  managers, 
regulatory  bodies,  audit  agencies,  the  courts,  Congress  and 
the  President,  among  others.   If  there  is  any  weakness  that 
indicates  a  breakdown  in  control  to  these  controlling  parties 
they  will  be  concerned.   An  example  would  be  the  recent  spare 
parts  problem  ($500  hammers,  $600  toilet  seats,  etc.)  in  the 
Department  of  Defense.   This  situation  has  caused  increased 
attention  from  Congress,  the  GAO  and  other  groups.   This  may 
result  in  reduced  levels  of  funding,  tighter  regulation  and 
other  restrictions.   This  results  from  the  apparent  lack  of 
control  by  the  parties  that  control  the  agency  which  allowed 
a  situation  like  this  to  develop. 

c.  Interested  Parties  In  The  Press  And  Media 

Most  agencies  in  the  Federal  Government  receive 
the  attention  of  the  news  media.   This  is  especially  true 
when  weaknesses  are  uncovered.   This  is  because  the  media 
considers  poor  management  in  the  government  to  be  news. 
The  spare  parts  problem  in  DOD  is  again  an  excellent  example. 
When  this  was  uncovered,  it  received  substantial  coverage 
by  the  media.   Of  course,  the  media  coverage  caused  an  impact 
on  those  who  control  the  agency  and  so  there  was  a  domino 
type  effect  from  the  coverage.   Generally  it  is  safe  to  assume 
if  an  item  is  newsworthy,  the  media  will  give  it  their  attention 
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d.  The  Public  At  Large 

The  democratic  society  in  America  gives  each 
citizen  an  interest  in  the  affairs  of  the  Federal  Government. 
In  addition,  there  is  a  vast  amount  of  information  available 
to  the  public  about  government  affairs.   While  the  average 
citizen  may  not  be  affected  by  an  agency,  they  may  still  have 
an  interest  in  the  agency.   The  impact  on  the  public  from  an 
agency  weakness  may  result  in  a  decrease  of  public  confidence 
This  in  turn  may  result  in  interest  from  those  who  control 
the  agency  and  the  media.   The  DOD  spare  parts  problem  is 
again  an  excellent  example.   While  the  public  may  not  under- 
stand complex  defense  issues,  they  do  perceive  that  $500  is 
too  much  to  pay  for  a  claw  hammer  that  is  similar  in  all 
respects  to  one  at  the  local  hardware  store  that  sells  for 
$10.   The  concern  of  the  public  at  large  cannot  be 
underemphasized. 

e.  Other  Interested  Parties 

An  agency  of  the  Federal  Government  may  have  an 
impact  on  groups  that  are  not  normally  associated  with  it. 
These  may  include  foreign  governments,  special  interest 
groups,  local  organizations  and  the  like.   If  these  other 
groups  can  be  identified,  the  impact  of  possible  agency  weak- 
nesses on  them  should  be  evaluated. 

4 .   Developing  Standards  Of  Materiality 

The  standards  that  should  be  used  for  materiality  in 
the  Federal  Government  should  be  developed  considering  the 
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interested  parties.   When  possible  they  should  be  quantified 
and  expressed  in  dollars.   However,  in  many  cases  the  standard 
will  be  subjective  and  judgment  will  have  to  be  the  sole  con- 
sideration.  Within  an  agency  the  standards  may  vary  down  the 
organizational  line  and  all  but  the  smallest  agencies  should 
not  set  overall  guidelines.   Rather,  the  segments  of  the  agency 
should  develop  their  own  standards  of  materiality  within  the 
framework  of  the  services  they  provide  and  how  they  affect 
interested  parties.   Although  an  overall  materiality  guide- 
line can  be  promulgated  by  the  agency,  this  guideline  should 
only  be  used  to  evaluate  materiality  for  the  agency  as  a  whole. 

F .   SUMMARY 

The  concept  of  materiality  in  the  private  sector  is  used 
by  professional  auditors  (CPA's)  to  evaluate  the  presentation 
of  a  business' s  financial  statements.   The  level  of  materiality 
is  based  on  standards  developed  with  the  user  of  the  financial 
statement  in  mind.   (What  would  the  user  consider  to  be 
material?)   Armed  with  these  guidelines,  the  auditor  develops 
an  audit  plan  that  will  provide  him  or  her  with  sufficient 
evidential  matter  to  evaluate  the  financial  statements.   This 
evidence  will  allow  the  auditor  to  conclude  if  there  are  any 
material  misstatements.   The  levels  of  materiality  are  adjusted 
by  the  auditor  to  include  the  risk  that  using  a  certain  level, 
the  auditor  might  let  a  material  error  go  undetected. 

Rather  than  being  strict  guidelines,  the  materiality 
levels  used  by  the  CPA  are  fluid  and  dynamic.   The  professional 
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judgment  of  the  CPA  must  be  used  to  make  these  determinations. 
The  auditors  that  make  these  judgments  typically  have  4  to 
5  years  of  college  with  an  accounting  major,  pass  a  grueling 
qualification  exam  and  generally  have  5  or  more  years  of  audit 
experience.   In  addition,  most  auditors  making  materiality 
decisions  have  substantial  experience  with  the  business  they 
are  evaluating. 

Each  audit  requires  a  different  perspective  of  materiality 
that  varies  with  the  business,  users  and  even  the  auditor. 
Indeed,  a  study  of  materiality  decisions  made  by  professional 
auditors  concluded  "that  individual  differences  emerge  both 
in  the  choice  of  factors  used  by  auditors  to  rank  materiality., 
and  their  materiality  thresholds"  [Ref.  19].   Even  though 
there  has  been  continuing  discussion  of  establishing  uniform 
standards  for  materiality  over  many  years,  it  seems  that  the 
nature  of  the  concept  will  not  allow  it.   However,  the  growing 
emphasis  on  a  higher  level  of  accountability  will  force  the 
CPA's  to  reevaluate  their  perception  of  materiality  in  their 
approach  to  an  audit. 

The  concept  of  materiality  in  the  Federal  Government, 
while  similar  in  some  respects  to  that  of  the  private  sector, 
must  be  applied  differently.   In  addition  to  the  typical 
financial,  internal  and  external  aspects,  the  stewardship  of 
the  agency  to  interested  parties  must  be  remembered.   The 
responsibility  that  agencies  have  as  a  result  of  this  steward- 
ship will  always  be  higher  than  that  of  businesses  in  the 
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private  sector.   The  application  of  materiality  therefore 
must  reflect  that  higher  responsibility. 
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V.   DETERMINING  MATERIAL  WEAKNESSES  IN  INTERNAL  CONTROL  SYSTEMS 

A.   INTRODUCTION 

The  final  process  in  the  evaluation  of  internal  control 

systems  for  the  Federal  Managers1  Financial  Integrity  Act, 

is  the  determination  of  material  weaknesses.   Any  weaknesses 

that  are  deemed  to  be  material  and  significant  to  Congress  or 

the  President  must  be  included  in  the  annual  report.   The  OMB 

Circular  A-123  defines  a  material  weakness  as: 

a  situation  in  which  the  designed  procedures  or  degree 
of  operational  compliance  therewith  does  not  provide 
reasonable  assurance  that  the  objectives  of  internal 
control  specified  in  the  Act  are  being  accomplished. 
[Ref.  20] 

In  the  previous  chapters,  the  difficulty  of  applying  this 
concept  of  materiality  to  the  determination  of  material 
weaknesses  was  brought  out.   The  principle  of  reasonable 
assurance  tends  to  confuse  the  materiality  issue.   As  defined 
in  a  prior  chapter,  reasonable  assurance  means  that  the  bene- 
fit derived  from  the  control  exceeds  the  cost  of  the  control. 
It  seems  that  a  correlation  can  be  drawn  between  the  concept 
of  audit  risk  in  the  private  sector  and  the  concept  of  reason- 
able assurance  as  used  in  the  above  definition  of  materiality. 

In  addition  to  the  guidance  given  in  OMB  Circular  A-123, 
the  Committee  On  Government  Operations  of  the  United  States 
Congress  has  provided  their  guidance.   In  a  report  on  first- 
year  implementation  of  the  Act,  the  committee  cautioned 
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against  the  exclusive  use  of  the  financial  accounting  defini- 
tion of  materiality.   They  stated: 

...the  Committee  is  concerned  with  the  lack  of  consistency 
in  agencies'  implementation  of  the  reporting  requirements. 
Consistent  understanding  of  the  meaning  of  material  weak- 
ness and  full  reporting  of  material  weaknesses  is  central 
to  achieving  the  accountability  envisioned  by  the  Act. 
The  Committee  believes  that  a  management  deficiency  should 
be  considered  a  material  weakness  for  purposes  of  reporting 
under  the  Act  if  it  could  impair  fulfillment  of  an 
agency's  mission,  deprive  the  public  of  needed  government 
services,  violate  statutory  or  regulatory  requirements, 
or  result  in  a  conflict  of  interest.   [Ref.  21] 

The  purpose  of  this  chapter  is  to  attempt  to  integrate  the 

concept  of  materiality  in  the  private  sector,  that  of  the 

Federal  Government  and  the  desire  of  Congress  into  a  workable 

guideline  for  the  determination  of  material  weaknesses. 

B.   REASONABLE  ASSURANCE  AND  AUDIT  RISK 

Audit  risk  as  used  by  the  auditor  in  the  private  sector 
is  the  risk  that  the  audit,  and  the  opinion  given  on  that 
audit,  might  not  reveal  a  material  misstatement  in  the  finan- 
cial statements  of  the  business  being  audited.   In  cases 
where  the  possibility  of  a  material  misstatement  is  low,  the 
audit  risk  is  low  and  vice  versa.   The  private  sector  auditor 
determines  the  scope  and  nature  of  his  or  her  audit  procedures 
based  on  an  assessment  of  audit  risk.   If  the  assessment  or 
audit  risk  is  high,  the  scope  and  nature  of  audit  procedures 
is  increased  and  vice  versa.   There  appears  to  be  a  similar 
correlation  between  the  materiality  of  an  internal  control 
weakness,  and  reasonable  assurance  in  the  Federal  Government. 
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For  each  area  of  internal  control  being  evaluated  in 
the  Federal  Government,  the  amount  of  assurance  that  is  con- 
sidered "reasonable"  varies.   For  example,  in  the  case  of  a 
control  dealing  with  the  safeguarding  of  nuclear  weapons,  the 
amount  of  assurance  considered  reasonable  would  be  absolute 
assurance.   In  other  words,  any  weakness  in  that  control 
would  be  material.   On  the  other  hand,  a  control  on  ball 
point  pens  might  give  reasonable  assurance,  and  sill  allow 
an  immaterial  amount  of  loss.   Therefore,  in  cases  where  the 
reasonable  assurance  that  is  desired  from  the  control  is 
high,  the  materiality  threshold  drops  and  vice  versa.   This 
principle,  along  with  those  developed  in  previous  chapters, 
will  be  used  in  the  guidelines  for  material  weaknesses. 

C.   GUIDELINES  FOR  MATERIAL  WEAKNESS  DETERMINATION 

Materiality  decisions  in  the  private  sector  are  made  by 
trained  professionals  with  substantial  experience  in  the  field. 
The  decisions  being  made  in  the  Federal  Government  are  made 
by  line  managers  with  limited  training  and  experience  in  this 
area.   For  this  reason,  a  systematic  "cookbook"  type  approach 
should  be  used.   This  approach  begins  after  the  identification 
of  weaknesses  in  the  internal  control  review  phase  noted  in 
Chapter  III.   Once  the  internal  control  weaknesses  have  been 
identified,  they  should  be  evaluated  using  the  following 
process . 
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1.  Area  Subject  To  Internal  Control 

The  first  part  of  the  weakness  evaluation  is  a  judg- 
ment on  the  sensitivity  of  the  area  subject  to  the  control. 
This  is  where  the  reasonable  assurance  principle  applies.   If 
the  area  is  very  sensitive,  such  as  nuclear  weapons,  the 
amount  of  assurance  required  is  high.   The  determination  is 
critical,  because  the  level  of  materiality  rests  with  the  amount 
of  reasonable  assurance  required.   (This  inverse  relationship  is 
graphically  illustrated  in  Figure  2.) 

2 .  Result  Of  Weakness  In  Control 

This  step  involves  an  evaluation  of  what  could  result 
from  the  control  weakness.   If  possible  this  result  should 
be  quantified.   If  not,  then  a  narrative  description  of  the 
result  should  be  prepared.   This  step  would  also  include  a 
judgment  as  to  whether  the  weakness  impairs  fulfillment  of 
the  agency  mission,  deprive  the  public  of  needed  government 
services,  violate  statutory  or  regulatory  requirements,  or 
result  in  a  conflict  of  interest.   This  step  determines  only 
the  possible  results  but  not  the  likelihood  of  those  results. 

3 .  Likelihood  Of  Results  From  Control  Weakness 
After  determining  the  possible  results  from  a  con- 
trol weakness,  the  likelihood  of  those  results  occurring  must 
be  assessed.   This  judgment  can  be  made  based  on  statistical 
methods,  prior  experience  or  any  method  that  can  reliably 
estimate  the  likelihood.   If  there  is  little  or  no  potential 
for  the  resutls  to  occur,  the  weakness  is  probably  immaterial. 
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However,  if  the  reasonable  assurance  required  by  the  control 
area  is  high  (e.g. ,  nuclear  weapons) ,  then  even  a  small 
likelihood  could  be  material.   In  this  case  additional  evalua- 
tion is  necessary  to  ensure  the  weakness  is  not  material. 
4 .   Parties  Affected  By  Control  Weakness 

At  this  point  the  focus  of  the  evaluation  changes 
from  the  weakness  to  those  affected  by  the  weakness.   These 
parties  include  all  those  listed  in  Chapter  IV  as  interested 
parties.   In  addition  to  the  identification  of  these  parties, 
the  effect  of  the  control  weakness  on  them  must  be  evaluated. 

a.  How  Are  Parties  Affected 

For  each  category  of  interested  parties  identified, 
a  determination  of  how  they  are  affected  must  be  made.   This 
does  not  have  to  be  specific,  but  only  to  what  extent  the 
party  is  affected.   In  the  case  of  the  media,  the  effect 
might  range  from  no  press  interest  to  nationwide  television 
coverage.   Similar  correlations  to  this  should  be  made  for 
each  category  of  interested  party.   At  this  step,  if  there  is 
no  effect  from  the  control  weakness  on  the  parties  identified, 
the  weakness  probably  is  not  material. 

b.  Reaction  Of  Interested  Party 

If  the  interested  party  is  affected  by  the  control 
weakness,  then  their  reaction  must  be  evaluated.   This  also 
does  not  have  to  be  specific  but  can  range  from  no  reaction 
to  extreme  reaction.   Although  there  is  a  connection  between 
the  effect  and  the  reaction,  they  should  be  evaluated 
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separately  to  ensure  that  they  are  considered  separately. 
Even  some  weaknesses  with  little  effect  can  provoke  an  extreme 
reaction. 

c.   Impact  Of  The  Reaction  Of  Interested  Party 
It  there  has  been  a  determination  that  the 
interested  party  will  be  affected  by  the  control  weakness 
and  have  a  negative  reaction  to  that  effect,  the  impact  of 
that  reaction  must  be  evaluated.   In  the  case  of  a  controlling 
party  like  Congress,  will  the  reaction  result  in  reduced 
funding  for  the  agency?   In  the  case  of  the  public,  will  the 
reaction  result  in  distrust?   Will  the  ability  of  the  agency 
to  fulfill  its  mission  be  diminished?   These  areas  and  more 
must  be  considered  in  this  judgment. 

5 .   Results  From  Material  Weakness  Guidelines 

Once  the  control  weakness  has  been  evaluated  using 
these  guidelines,  a  judgment  on  the  materiality  of  the  weak- 
ness can  be  made.   If  the  weakness  is  in  a  control  area  that 
requires  a  high  reasonable  assurance,  and  there  is  a  high 
probability  of  adverse  results,  it  is  definitely  a  material 
weakness.   Conversely,  if  it  requires  a  low  reasonable 
assurance,  and  there  is  a  low  probability  of  adverse  results, 
it  is  definitely  not  a  material  weakness.   Any  weaknesses 
that  lie  somewhere  between  these  extremes,  are  subject  to 
the  judgment  of  the  evaluator  as  to  their  materiality.   How- 
ever, the  process  of  using  the  guidelines  to  evaluate  the 
weakness  will  enhance  the  evaluator 's  knowledge  of  the  weak- 
ness, and  subsequently  his  or  her  judgment. 
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D.   IMPLEMENTATION  OF  GUIDELINES  FOR  MATERIAL  WEAKNESS 
DETERMINATION 

In  most  evaluations  of  internal  control  systems,  a  check- 
list type  form  is  used.   This  form  is  adapted  to  fit  the  system 
being  evaluated  and  often  is  specifically  written  for  each 
control.   This  technique  insures  that  the  evaluator  performs 
each  and  every  step  of  the  review  process.   This  same  tech- 
nique should  be  used  for  the  evaluation  of  material  weaknesses. 
A  sample  checklist  is  included  as  Appendix  A  of  this  thesis. 

The  sample  checklist  is  designed  to  be  used  once  a  weak- 
ness has  been  identified,  and  is  based  on  the  guidelines  in 
this  chapter.   The  checklist  contains  a  12-step  process  that 
helps  the  evaluator  determine  the  materiality  of  a  weakness. 
Those  steps  include: 

1.  Area  subject  to  control.   An  assessment  is  made  on 
how  sensitive  the  area  being  controlled  is  to  risk. 
Once  the  sensitivity  is  evaluated,  the  reasonable 
assurance  required  by  the  control  can  be  determined. 

2.  Possible  results  from  the  control  weakness.   A  deter- 
mination is  made  on  the  possible  outcomes  from  the 
weakness  in  internal  control. 

3 .  Likelihood  of  possible  results  from  the  control  weakness. 
The  results  listed  in  Step  2  are  evaluated  for  their 
potential  to  occur. 

4 .  First  determination  of  materiality.   Based  on  the 
information  gained  in  Steps  1-3,  the  materiality  of 
certain  weaknesses  can  be  ascertained.   If  the 
materiality  of  the  weakness  cannot  be  determined 

at  this  point,  the  checklist  is  continued. 

5 .  Interested  parties  affected  by  results  from  control 
weakness .   In  this  step  a  list  is  made  of  those 
parties  that  could  be  affected  by  the  results  of  the 
control  weakness. 
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6 .  How  are  interested  parties  affected  by  the  results. 
The  evaluator  makes  an  assessment  on  the  impact  of  the 
control  weakness  on  the  interested  parties  identified 
in  Step  5. 

7.  Second  Determination  of  material  weakness.   At  this 
point  the  materiality  of  certain  weaknesses  can  be 
ascertained.   The  checklist "is  continued  for  those  that 
are  still  not  determinable. 

8 .  Reaction  of  interested  parties  to  results  from  control 
weakness .   This  step  evaluates  the  reaction  of  the 
parties  listed  in  Step  5  to  the  effect  of  the  control 
weakness  identified  in  Step  6. 

9 .  Third  determination  of  material  weakness.   Based  on 
the  information  gained  in  Steps  6-8,  the  materiality 
of  certain  weaknesses  can  be  determined.   For  those 
that  are  still  not  determinable  the  checklist  is 
continued. 

10.  Impact  of  reaction  of  interested  party.   The  evaluator 
makes  an  assessment  of  the  impact  on  the  agency  from 
the  reactions  listed  in  Step  8. 

11.  Fourth  determination  of  material  weakness.   The 
materiality  of  certain  weaknesses  can  be  determined  at 
this  point.   For  those  that  are  still  not  determin- 
able, the  checklist  is  continued. 

12.  Final  determination  of  material  weakness.   At  this  point 
the  checklist  procedure  stops  and  the  evaluator  makes 

a  judgment  on  the  materiality  of  the  weakness.   The 
logic  behind  this  evaluation  should  be  documented. 

The  quality  of  the  determination  of  materiality  obtained  from 

the  checklist  is  dependent  on  the  evaluator.   It  is  not  a 

substitute  for  training  and  experience. 

This  material  weakness  checklist  can  be  adapted  by  the 

agency  and  its  segments  to  fit  their  specific  needs.   The 

establishment  of  specific  limits  of  materiality  (such  as 

dollar  limits)  can  be  set  by  the  segment  performing  the 

evaluation,  or  the  authority  it  reports  to.   Either  way, 

each  weakness  determined  to  be  material,  and  those  that  are 

not  definitely  immaterial,  should  be  reported  to  the 

76 


segment's  next  higher  management  responsibility  level.   This 
way  the  material  weaknesses  can  be  evaluated  for  that  level 
as  a  whole,  and  a  determination  made  if  they  should  be 
reported  to  the  next  level. 
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VI.   CONCLUSIONS  AND  RECOMMENDATIONS 

A.  INTRODUCTION 

The  purpose  of  this  thesis  was  to  review  the  process  of 
evaluating  internal  control  systems  for  the  Federal  Managers  * 
Financial  Integrity  Act  and  the  application  of  the  concept  of 
materiality  to  that  process.  Pertinent  information  gained  in 
this  research  was  documented  in  the  previous  chapters,  and 
resulted  in  the  guidelines  covered  in  the  last  chapter.  This 
chapter  will  present  conclusions  and  recommendations. 

B.  CONCLUSIONS 

The  intent  of  Congress  in  the  Federal  Managers '  Financial 
Integrity  Act  was  to  eliminate  fraud,  waste  and  abuse  in 
agencies  of  the  Federal  Government.   The  main  tool  used  in 
this  effort  is  the  internal  control  systems  required  by  each 
agency.   Although  Congress  intended  the  annual  reporting  re- 
quirement to  provide  agency  accountability,  it  did  not  estab- 
lish materiality  guidelines. 

The  lack  of  materiality  guidelines  from  Congress,  OMB  or 
other  regulatory  bodies  has  caused  confusion  among  most  agen- 
cies about  what  constitutes  a  material  weakness  in  internal 
controls.   This  confusion  stems  from  the  limited  knowledge 
about  the  implementation  and  evaluation  of  internal  controls 
in  the  Federal  Government.   Although  the  promulgation  of 
overall  materiality  standards  by  Congress,  OMB  or  other 
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regulatory  agency,  would  make  the  agency  evaluation  easier, 
it  does  not  appear  likely. 

Materiality  decisions  are  made  on  a  daily  basis  by  auditors 
in  the  private  sector.   They  are  made  based  on  the  high  level 
of  education,  training  and  experience  held  by  these  auditors. 
Since  internal  control  evaluation  and  review  in  the  Federal 
Government  is  performed  by  line  managers,  in  most  cases  they 
will  not  be  as  qualified  as  private  sector  auditors.   There- 
fore, managers  making  these  evaluations  need  additional 
training  and  aids  such  as  checklists  to  complete  their  review 
of  internal  controls. 

Although  overall  materiality  levels  can  be  set  for  an 
agency  to  determine  what  material  weaknesses  should  be  reported 
in  the  annual  statement,  the  level  of  materiality  for  segments 
within  an  agency  should  be  developed  specifically  for  each 
segment.   The  method  used  by  some  agencies  of  setting  a  quan- 
titative materiality  threshold  (i.e.,  $250,000),  for  use 
throughout  the  agency,  could  result  in  material  weaknesses 
being  ignored.   Furthermore,  this  policy  does  not  allow  the 
intent  of  the  Act  to  be  followed.   That  is,  the  improvement 
of  internal  control  systems  throughout  the  agency  for  the  pre- 
vention of  fraud,  waste  and  abuse. 

The  internal  control  evaluation  required  by  the  Act,  has 
the  potential  to  improve  the  overall  system  of  internal  con- 
trol in  the  Federal  Government.   However,  the  Congress  and 
the  agencies  must  avoid  making  the  evaluation  simply  a  method 
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of  meeting  the  annual  reporting  requirements .   The  review 
of  internal  controls  should  be  conducted  first  for  the 
evaluation  and  improvement  of  internal  controls,  and  second 
for  the  annual  report. 

C.   RECOMMENDATIONS 

The  internal  control  evaluation  process  and  the  deter- 
mination of  material  weaknesses  can  be  improved  with  the 
implementation  of  these  recommendations  in  Federal  Government 
agencies . 

1 .  Increased  Training  For  Management 

The  amount  of  training  for  managers  involved  with 
the  internal  control  evaluation  should  be  increased.   This 
training  should  include  a  thorough  indoctrination  in  the 
concept  of  materiality  and  its  application  to  the  determina- 
tion of  material  weaknesses. 

2 .  Checklists  For  Material  Weakness  Determination 

The  checklist  included  as  Appendix  A  of  this  thesis 
should  be  used  to  determine  material  weaknesses.   This  check- 
list should  be  adapted  by  each  segment  of  an  agency  to  incor- 
porate its  own  unique  internal  control  systems.   Internal 
control  weaknesses  uncovered  in  the  review  process  should  be 
evaluated  for  materiality  by  using  these  checklists. 

3 .  Reporting  Of  Material  Weaknesses 

Each  segment  of  an  agency  should  report  the  weaknesses 
that  are  deemed  material  and  those  that  are  not  definitely 
immaterial  (those  subject  to  judgment) ,  to  the  next 


80 


responsibility  level.   At  each  successive  level,  the  process 
of  evaluating  the  materiality  should  be  repeated  to  determine 
if  the  weakness  should  be  reported  to  the  next  responsibility 
level.   The  weaknesses  that  are  included  in  the  annual  report 
to  Congress  and  the  President  should  include  any  problem  that 
is  "significant  to  a  program  or  individual  agency  component" 
[Ref.  22 J .   Therefore,  the  dismissal  of  segment  material 
weaknesses  as  immaterial  to  the  agency  as  a  whole  should  be 
approached  with  caution. 

4 .  Establishment  Of  Dollar  Thresholds 

Although  the  use  of  specific  dollar  thresholds  of 
immateriality  can  make  the  determination  of  a  material  weak- 
ness easier,  they  are  not  exclusive.   For  example,  while  the 
$600  aircraft  toilet  seat  would  be  well  below  most  thresholds 
of  materiality  expressed  in  dollars,  it  is  clear  that  the 
resultant  press  and  Congressional  interest  makes  it  material. 
Therefore,  dollar  thresholds  should  be  used  with  caution, 
and  are  best  suited  for  financial  accounting  controls. 

5 .  Emphasis  On  Internal  Control  Improvement 

The  annual  reporting  requirement  was  developed  to 
insure  that  agencies  in  the  Federal  Government  accounted  for 
their  internal  control  systems.   However,  the  annual  report 
must  not  become  the  means  to  the  end.   The  primary  focus  of 
the  internal  control  evaluation  process  must  be  on  the  segment 
level  review.   Agencies  should  insure  that  each  segment  evalu- 
ates their  internal  control  system,  determines  weaknesses, 
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the  materiality  of  those  weaknesses  and  reports  the  findings 
to  their  next  responsibility  level.   In  addition,  each  segment 
should  take  steps  to  improve  those  controls  which  have  material 
weaknesses  which  will  result  in  more  effective  systems  of 
internal  control. 
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APPENDIX  A 
MATERIAL  WEAKNESS  CHECKLIST 

For  each  internal  control  weakness  discovered  in  the  internal 
control  review,  complete  a  separate  checklist. 


Internal  Control  Weakness 

1.   Area  Subject  To  Control 

Give  a  brief  description  of  area  subject  to  control  that 

contains  a  weakness. 


How  sensitive  is  the  area  described  above,  to  risk?   This 
includes  the  risk  of  loss,  fraud,  waste  and  abuse.   If  a  quan- 
titative threshold  (i.e.,  dollars)  is  available,  the  sensi- 
tivity can  be  evaluated  as  the  risk  of  exceeding  that  threshold 
In  addition,  access  the  risk  of  impairment  of  mission  fulfill- 
ment, deprivation  of  needed  services  to  the  public,  violation 
of  statutory  or  regulatory  requirements  and  conflict  of 
interest. 

SENSITIVE    MODERATELY  SENSITIVE    NOT  SENSITIVE. 

Based  on  the  sensitivity,  select  the  reasonable  assurance 
required.   There  is  a  direct  correlation  between  sensitivity 
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and  reasonable  assurance  required  (i.e.,  sensitive  to  risk 
equals  high  reasonable  assurance) . 

HIGH      MEDIUM      LOW 

2 .   Possible  Results  From  Control  Weakness 

Give  a  brief,  itemized  description  of  possible  results  from 
this  control  weakness.   If  the  result  can  be  quantified  in 
dollars,  list  the  amount  of  possible  loss.   Do  not  consider 
the  likelihood  of  these  results  in  this  step,  only  the 
possibility  of  these  results. 


3 .   Likelihood  Of  Possible  Results  From  Control  Weakness 
For  every  possible  result  included  in  Step  2,  evaluate  the 
likelihood  of  that  result  occurring.   The  evaluation  should 
use  three  levels  of  potential: 

LIKELY      POSSIBLE      NOT  LIKELY 
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4 .  First  Determination  Of  Material  Weakness 

If  at  this  point  the  control  weakness  being  evaluated  requires 
high  reasonable  assurance  per  Step  1,  and  any  results  deter- 
mined in  Step  2  are  evaluated  as  likely  or  possible  in  Step  3, 
the  weakness  is  material.   If  the  weakness  requires  low 
reasonable  assurance,  and  all  results  in  Step  3  are  not 
likely,  the  weakness  is  not  material.   Based  on  this  criteria, 
select  one  choice  for  the  weakness  being  evaluated. 

MATERIAL      IMMATERIAL      NOT  DETERMINABLE 

If  the  weakness  is  judged  to  be  material,  it  should  be  reported 
and  corrective  action  taken.   If  the  weakness  is  judged  to 
be  immaterial,  no  further  action  is  required.   If  the 
materiality  of  the  weakness  is  not  determinable  at  this  point, 
continue  with  the  checklist. 

5 .  Interested  Parties  Affected  By  Results  From  Control  Weakness 
For  each  result  in  Step  2  that  is  considered  to  be  likely  or 
possible  in  Step  3,  list  the  categories  of  interested  parties 
affected  by  the  results.   These  can  be  those  who  benefit  from 
the  area  in  question,  those  who  control  the  agency,  the  public 
at  large,  press  and  media  or  others. 
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6 .   How  Are  Interested  Parties  Affected  By  Results 
For  each  category  of  interested  party  determined  in  Step  5, 
briefly  describe  how  they  are  affected  by  the  results  of  the 
control  weakness.   The  party  may  be  affected  by  one  or  all 
possible  results.   This  effect  may  be  in  the  form  of  depriva- 
tion of  agency  services,  press  interest,  etc.   For  each 
category  of  interested  party  list  the  effect  and  its  impact 
as : 

SEVERE      MEDIUM      INSIGNIFICANT 


7 .  Second  Determination  Of  Material  Weakness 

If  at  this  point,  if  any  interested  party  identified  in  Step 
5  is  evaluated  in  Step  6  as  having  a  severe  effect  from  the 
result,  the  weakness  is  material.   Based  on  this  determination, 
select  one  choice: 

MATERIAL      NOT  DETERMINABLE 

If  the  weakness  is  material,  report  it  and  take  corrective 
action.   If  it  is  not  determinable,  continue  with  the 
checklist. 

8 .  Reaction  Of  Interested  Parties  To  Results  From  Control 
Weakness 

If  the  materiality  of  the  weakness  was  not  determinable  in 

Step  7,  evaluate  the  reaction  of  all  categories  of  interested 
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parties  identified  as  being  affected  by  the  results  of  the 
control  weakness  in  Step  6.   Evaluate  their  reaction  as: 

EXTREME      MODERATE      INDIFFERENT 


9 .  Third  Determination  Of  Material  Weakness 

If  all  the  interested  party  reactions  identified  in  Step  9 
are  indifferent,  the  weakness  is  immaterial.   Based  on  this 
determination,  select  one  choice: 

IMMATERIAL      NOT  DETERMINABLE 

If  the  weakness  is  immaterial,  no  further  action  is  required 
If  the  materiality  of  the  weakness  is  not  determinable, 
continue  with  the  checklist. 

10 .  Impact  Of  Reaction  Of  Interested  Party 

What  will  the  impact  of  the  reaction  identified  in  Step  8 
be  to  the  program  or  agency?   This  could  reduce  funding  from 
controlling  groups,  public  distrust,  inability  to  fulfill 
the  mission,  etc.   For  each  reaction  evaluated  as  extreme  or 
moderate  in  Step  8,  evaluate  the  impact  as: 

SEVERE      MODERATE      INSIGNIFICANT 
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11 .  Fourth  Determination  Of  Material  Weakness 

If  any  interested  party  reaction  is  evaluated  as  having  a 
severe  impact  in  Step  10,  the  weakness  is  material.   If  the 
impact  is  evaluated  as  insignificant,  the  weakness  is  proba- 
bly immaterial.   Based  on  this  determination,  select  one 
choice : 

MATERIAL      IMMATERIAL      NOT  DETERMINABLE 

If  the  weakness  is  material,  report  it  and  take  corrective 
action.   If  it  is  immaterial,  no  further  action  is  required. 
Continue  with  the  checklist  if  the  materiality  is  not 
determinable . 

12 .  Final  Determination  Of  Material  Weakness 

At  this  point  the  evaluator  must  use  his  or  her  judgment  in 
determining  whether  a  weakness  is  material  or  immaterial. 
Based  on  the  knowledge  and  experience  the  evaluator  has, 
outside  expertise  if  available,  and  any  other  resources, 
determine  if  the  weakness  is: 

MATERIAL      IMMATERIAL 

Provide  a  brief  narrative  on  the  basis  for  this  determination 
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If  the  weakness  is  material,  report  it  and  take  corrective 
action.   If  it  is  immaterial,  no  further  action  is  required 
Include  this  checklist  with  the  working  papers  for  the 
internal  control  evaluation. 
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